acp-orders-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill primarily consists of implementation guidelines, architectural diagrams, and protocol definitions for handling commerce events and securing them with HMAC-SHA256 signatures.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use
WebSearchandWebFetchto obtain live documentation and code examples from established platforms including GitHub, OpenAI, and Stripe. These references target reputable organizations for development purposes. - [INDIRECT_PROMPT_INJECTION]: The skill involves ingesting external documentation, which represents a data ingestion surface. However, this is limited to trusted developer documentation domains.
- Ingestion points: External documentation is retrieved using
WebSearchandWebFetchtools as described in the 'Before writing code' section of SKILL.md. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: The skill has access to file system modification (
Write,Edit) and shell execution (Bash) tools. - Sanitization: Not explicitly mentioned in the skill text.
Audit Metadata