mercado-pago
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the Membrane CLI (
@membranehq/cli) via npm. This is a vendor-provided tool used to manage authentication and proxy API requests to Mercado Pago. All external resources (domain, repository, and npm package) are owned by the vendor (membranedev/membranehq). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process data from Mercado Pago, such as payment details and merchant orders. While this represents a potential surface where external content could influence agent behavior, the risk is low due to the structured nature of financial data and the use of the vendor's proxy which sanitizes interactions.
Audit Metadata