Skills
Navigate
skills/orcaqubits/agentic-commerce-skills-plugins/ucp-location/Gen Agent Trust Hub

ucp-location

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to fetch external specifications via the web, which introduces a surface for indirect instructions to be processed by the agent.
  • Ingestion points: The skill instructions specify fetching the capability and operation pages from the ucp.dev domain (SKILL.md).
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the fetched content are provided.
  • Capability inventory: The skill allows access to potentially sensitive tools including Bash, Write, and Edit.
  • Sanitization: The instructions do not describe any sanitization or validation of the data retrieved from the external specifications.
  • [EXTERNAL_DOWNLOADS]: The skill references an external repository for implementation samples.
  • Source: The documentation links to https://github.com/Universal-Commerce-Protocol/samples as a reference implementation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 06:33 PM