acp-delegated-payment
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch documentation and specifications from external websites. This introduces a potential surface for indirect prompt injection, as the agent processes external data without defined boundary markers or sanitization procedures.
- Ingestion points: The instructions in
SKILL.mddirect the agent to fetch content from OpenAI's developer portal and Stripe's documentation. - Boundary markers: No delimiters or "ignore embedded instructions" warnings are specified for the retrieved content to prevent it from influencing the agent's behavior.
- Capability inventory: The skill has access to system-level tools including
Bash,Write, andEditas defined in the allowed-tools frontmatter. - Sanitization: There are no instructions provided to validate, escape, or filter the content retrieved from external URLs before processing it.
- [EXTERNAL_DOWNLOADS]: The skill fetches implementation details and specifications from official documentation sites.
- Fetches payment specifications from OpenAI's official developer documentation.
- Fetches SharedPaymentToken implementation details from Stripe's official conceptual documentation.
Audit Metadata