mapi-developer-assistant
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [External API Interaction]: The skill uses
curlto interact withhttps://merchantapi.googleapis.com. This is a well-known service provided by the vendor (Google) to fetch documentation and code samples. This behavior is expected for a developer assistant skill and follows standard API interaction patterns. - [Shell Script Execution]: The skill includes two shell scripts (
scripts/query_mapi_docs.shandscripts/find_mapi_code_sample.sh) that are used to perform the API queries. These scripts include basic sanitization of input arguments (escaping double quotes) to ensure the generated JSON payloads are correctly formatted. This is a routine implementation for CLI-based tools. - [User Confirmation Guidelines]: The instructions explicitly state that the agent should never execute API calls that modify live data (such as
insert,delete, orupdate) without explicit user confirmation, which is a key safety measure for autonomous agents. - [Credential Safety]: The operational guidelines emphasize that the agent must never save real credentials or tokens to memory, aligning with security best practices for handling sensitive information.
Audit Metadata