hdfc-sg-integration
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches PHP integration kits and configuration templates from the vendor's repository at
https://raw.githubusercontent.com/juspay/merchant-skills/main/HDFC-SG/kits/php/. These are legitimate resources required for the integration. - [COMMAND_EXECUTION]: The skill instructs the agent to perform local file system operations, such as scanning for configuration files and writing SDK code to the project's backend directory. These operations are essential for the integration process.
- [DATA_EXFILTRATION]: No patterns of unauthorized data transfer were found. The skill explicitly instructs the agent to warn the user about missing security keys and ensures that the merchant handles sensitive
config.jsonfiles locally. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external kit files and the user's local codebase. While this constitutes an attack surface, the risk is mitigated by the trusted nature of the kit sources and the skill's emphasis on server-side validation and schema enforcement.
Audit Metadata