nfeio-node-sdk
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official
nfe-ionpm package, which is the legitimate SDK for the service provided by the vendor. - [COMMAND_EXECUTION]: Includes standard instructions for package installation (
npm install nfe-io) and example scripts for fiscal document management in Node.js. - [DATA_EXFILTRATION]: The SDK communicates with official NFE.io API endpoints (e.g.,
api.nfe.io,api.nfse.io,address.api.nfe.io) to process Brazilian electronic invoices. These operations are consistent with the skill's documented purpose. - [PROMPT_INJECTION]: The skill processes data from external API responses (e.g., invoice details, CNPJ/CPF lookups). While this represents an indirect prompt injection surface typical of data-ingesting skills, no malicious patterns or specific vulnerabilities were detected.
- Ingestion points: API responses from
api.nfe.ioand related subdomains (JSON/XML/PDF buffers). - Boundary markers: None explicitly defined in instructions.
- Capability inventory: Code examples utilize
node:fs(writeFileSync) and network requests (nativefetch). - Sanitization: Not explicitly mentioned in the skill documentation.
Audit Metadata