fluxa agentic checkout
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell command execution via Python's subprocess module in
scripts/setup_checkout_skill.pyto manage environment preparation, including virtual environment creation and dependency installation. Similarly,scripts/demo_execute_headed.pyuses subprocess to launch the main checkout automation script in a visible browser mode for demonstration purposes. - [EXTERNAL_DOWNLOADS]: During the setup phase initiated by
scripts/setup_checkout_skill.py, the skill downloads necessary Python libraries from standard registries and the Chromium browser runtime via the Playwright CLI to enable web automation. - [DATA_EXFILTRATION]: The skill is designed to handle highly sensitive data, including credit card numbers, CVVs, and personal addresses, for the purpose of filling web forms. It implements defensive measures for this data, such as using an interactive collection script (
scripts/setup_checkout_profile.py) that stores credentials in a local JSON file with restricted filesystem permissions (0o600) and masks card details during input prompts.
Audit Metadata