postedly-send-postcard
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows secure authentication practices by using standard OAuth 2.0 through the client's connection. It explicitly instructs the agent never to ask for passwords, tokens, or verification codes in chat.
- [SAFE]: Data privacy is maintained by directing the user to a private, hosted URL on the Postedly domain for sensitive actions such as reviewing proofs, verifying identity, and processing payments via Stripe Checkout. Payment details never enter the chat context.
- [SAFE]: The skill includes robust guardrails against indirect prompt injection by instructing the agent to treat any instructions found within uploaded documents as content rather than commands.
- [SAFE]: File transfer mechanisms are restricted to the official domain (postedly.com) with integrity checks (SHA-256) and explicit warnings against uploading files to unauthorized endpoints.
- [SAFE]: All external references and tools originate from the author's own infrastructure (postedly.com), representing intended vendor functionality without suspicious redirect or exfiltration patterns.
Audit Metadata