fluentcart-shipping-tax
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill promotes security best practices by explicitly instructing the agent to treat shipping and tax as server-owned calculations and warning against trusting customer-decided methods or totals.
- [INDIRECT_PROMPT_INJECTION]: The skill describes handling untrusted user data, specifically shipping addresses and EU VAT registration numbers. It addresses this surface by recommending normalization of country/VAT prefixes, the use of bounded network timeouts for external validation services, and performing full server-side re-validation of all logic following any input change.
- Ingestion points: Customer address input (country, state, postal code) and EU VAT registration strings in SKILL.md and shipping-tax-pipeline.md.
- Boundary markers: Instructions to re-resolve zone membership and method states on the server, rather than trusting stored cart choices.
- Capability inventory: Standard PHP logic for shipping and tax calculations (e.g., ShippingMethod, TaxCalculator) and network calls to external VAT validation providers.
- Sanitization: Guidance on normalizing data and validating consistency before applying reverse charge or tax logic.
Audit Metadata