mapi-developer-assistant

Pass

Audited by Gen Agent Trust Hub on Jul 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [External API Interaction]: The skill uses curl to interact with https://merchantapi.googleapis.com. This is a well-known service provided by the vendor (Google) to fetch documentation and code samples. This behavior is expected for a developer assistant skill and follows standard API interaction patterns.
  • [Shell Script Execution]: The skill includes two shell scripts (scripts/query_mapi_docs.sh and scripts/find_mapi_code_sample.sh) that are used to perform the API queries. These scripts include basic sanitization of input arguments (escaping double quotes) to ensure the generated JSON payloads are correctly formatted. This is a routine implementation for CLI-based tools.
  • [User Confirmation Guidelines]: The instructions explicitly state that the agent should never execute API calls that modify live data (such as insert, delete, or update) without explicit user confirmation, which is a key safety measure for autonomous agents.
  • [Credential Safety]: The operational guidelines emphasize that the agent must never save real credentials or tokens to memory, aligning with security best practices for handling sensitive information.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 26, 2026, 02:32 AM
Security Audit — agent-trust-hub — mapi-developer-assistant