nfeio-node-sdk
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides integration instructions for the
nfe-ionpm package, which is the official SDK for the NFE.io platform services. - [INDIRECT_PROMPT_INJECTION]: The skill documents methods for ingesting and processing data from external sources, such as webhook notifications and fiscal authority (SEFAZ) queries.
- Ingestion points: Webhook payload processing (documented in
references/service-invoices-and-polling.md) and API responses from CNPJ/CPF lookup services. - Boundary markers: The documentation explicitly instructs users to validate incoming webhook signatures using the
validateSignaturemethod to ensure data integrity. - Capability inventory: Examples demonstrate writing fiscal documents to the local filesystem using
writeFileSyncand performing authorized network requests via the SDK. - Sanitization: The skill emphasizes the use of raw request buffers for signature verification (HMAC-SHA1) to prevent tampering and ensure the authenticity of external fiscal data.
Audit Metadata