volume-pricing

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The custom implementation examples in SKILL.md process external parameters which creates a typical surface for indirect prompt injection findings.
  • Ingestion points: Functions resolveUnitPrice and updateCartLinePricing in SKILL.md ingest parameters productId, quantity, and customerGroup from the shopping context.
  • Boundary markers: The example implementation does not include explicit delimiters or directives to isolate these parameters from the prompt logic.
  • Capability inventory: The skill's logic involves database read and write operations (findActive, find, update) based on the input parameters.
  • Sanitization: The provided code snippets demonstrate object-based database queries which generally imply parameterized calls, though no explicit input validation logic is shown.
  • [SAFE]: The skill identifies and recommends official and reputable pricing tools for Shopify, WooCommerce, and BigCommerce stores. The architectural patterns for headless storefronts and PostgreSQL schema design follow industry standard practices for e-commerce pricing engines and do not contain any malicious patterns or unauthorized data access behaviors.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 11:01 AM