mapi-developer-assistant
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [External Data Retrieval]: The skill uses shell scripts to fetch documentation and code samples from
merchantapi.googleapis.comviacurl. These requests are directed to the vendor's official API infrastructure to provide real-time technical information. - [Indirect Prompt Injection Surface]: The skill processes data returned from an external API to answer user queries. While this creates a surface for potential indirect instructions, the skill is designed to retrieve documentation from a trusted source, and the agent is instructed to synthesize and interpret the results rather than executing them directly.
Audit Metadata