Skills
Navigate
skills/orcaqubits/agentic-commerce-skills-plugins/ucp-orders-webhooks/Gen Agent Trust Hub

ucp-orders-webhooks

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch live specifications from ucp.dev and a conformance test suite from the Universal-Commerce-Protocol organization on GitHub.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources, which could potentially contain instructions aimed at influencing the agent's implementation steps.
  • Ingestion points: Specification pages at ucp.dev and repository content at github.com/Universal-Commerce-Protocol/conformance via WebFetch.
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts in the fetched specifications.
  • Capability inventory: The skill allows Bash, Write, Edit, and WebFetch tools, which could be misused if the fetched content contains malicious commands.
  • Sanitization: There are no explicit instructions for the agent to sanitize or validate the external content before processing it for implementation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 06:33 PM