jp-architecture
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a disciplined micro-file architecture that ensures integration designs are strictly grounded in official Juspay documentation via the docs-mcp-server. This structure prevents the agent from asserting product facts from memory and ensures consistency with current platform capabilities.
- [DATA_EXFILTRATION]: The skill utilizes a telemetry tool, juspay_track_integration_stage, to monitor integration progress milestones. Analysis confirms this feature is restricted to non-sensitive metadata (such as product slugs and platforms) and includes explicit, mandatory instructions to exclude PII, API keys, merchant identifiers, or secret-bearing URLs.
- [CREDENTIALS_UNSAFE]: The skill provides robust security guidance for handling secrets. It explicitly mandates that credentials and API keys be managed via environment variables and strictly forbids their inclusion in project documentation, execution checklists, or application logs.
- [PROMPT_INJECTION]: The skill ingests external PRD documents to drive the architectural design process. While this represents a theoretical attack surface, the risk is mitigated by the skill's highly structured, step-by-step discovery workflow which requires user confirmation at each phase and focuses on generating static documentation rather than executing runtime code.
Audit Metadata