mp-integrate
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches documentation from mercadopago.com subdomains to scaffold code.
- Ingestion point: SKILL.md Step 3 (WebFetch call to llms.txt).
- Capability inventory: Write, Edit, and Bash execution (package installation and validation scripts).
- Boundary markers: None explicitly defined for remote content.
- Sanitization: Instructions indicate code blocks are used verbatim.
- [DYNAMIC_EXECUTION]: SKILL-migrate.md uses a node -e command string to fetch and process terminal lists from the vendor's API.
- [COMMAND_EXECUTION]: The skill executes local validation scripts bundled with the plugin (e.g., validate-point-server.mjs) and performs package management via npm install.
- [EXTERNAL_DOWNLOADS]: Fetches remote documentation and installs official SDKs. These are vendor-owned resources (mercadopago.com and official NPM packages) and are documented neutrally as intended functionality.
Audit Metadata