ap2-payment-processor
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture is designed to ingest and process data from external sources such as merchant payment mandates, third-party credential providers, and user-supplied OTP challenge responses, presenting an indirect prompt injection surface. * Ingestion points: Transaction data is received via payment requests, resolved credentials, and user challenge inputs (referenced in SKILL.md). * Boundary markers: Instructions lack explicit directives for using delimiters or boundary markers to isolate untrusted data. * Capability inventory: The skill is configured with powerful tools including Bash, Edit, and WebFetch. * Sanitization: No sanitization or content validation steps are mentioned for the external mandates or credential payloads.
- [EXTERNAL_DOWNLOADS]: The skill fetches protocol specifications and reference implementation details from an external source. * Evidence: The agent is instructed to fetch documentation from ap2-protocol.org/ap2/specification/ and ap2-protocol.org/overview/.
Audit Metadata