sf-payments
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes architectures and hooks that process untrusted data from orders and webhooks, which constitutes an indirect prompt injection surface.\n
- Ingestion points: External data enters the agent context through payment hook scripts (e.g., authorize.js) which receive basket and order objects, and through webhook events from payment processors.\n
- Boundary markers: The skill instructions do not explicitly provide boundary markers or delimiters for the agent to distinguish between instructions and data when processing these objects.\n
- Capability inventory: The skill is granted access to high-privilege tools such as Bash, Write, and Edit across its execution environment.\n
- Sanitization: The skill prioritizes PCI-compliant tokenization for payment credentials but does not detail sanitization requirements for general order metadata fields that might be processed by the agent or passed to shell tools.
Audit Metadata