fluentcart-downloads-storage
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides defensive security guidance for digital product delivery, focusing on credential management, least-privilege bucket policies, and path traversal prevention. It explicitly instructs the agent to protect private object storage and avoid raw file-path disclosure.- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external data from orders, products, and subscriptions to determine download entitlements. It includes necessary guidance for mitigating risks associated with untrusted data.
- Ingestion points: Data enters the context through
ProductDownloadrecords,Ordermetadata, and user-suppliedsigned delivery URLs(SKILL.md, references/download-delivery.md). - Boundary markers: The instructions mandate validation of signatures, timestamps, and payment status before any file operations are performed (references/download-delivery.md).
- Capability inventory: The system handles file streaming via storage drivers, network communication for S3/R2 providers, and cryptographic link generation (SKILL.md).
- Sanitization: The skill explicitly recommends path normalization, rejection of null bytes/traversal patterns, and validation of response filenames (references/download-delivery.md).
Audit Metadata