ucp-payment-authentication
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill content is educational and instructional, focusing on the implementation of UCP payment extensions. It includes mandatory security checks for developers, such as origin validation and strict adherence to authoritative checkout states.
- [EXTERNAL_DOWNLOADS]: The skill references a GitHub repository (
github.com/Universal-Commerce-Protocol/samples) for implementation examples. This is documented as a standard reference for the protocol being implemented. - [INDIRECT_PROMPT_INJECTION]: The skill involves processing signals (
action.ready,action.done) from external browser surfaces. It addresses potential risks by instructing the agent to treat external URLs as untrusted and to validate them against approved origins before use. - [COMMAND_EXECUTION]: The skill requires the use of WebSearch and WebFetch tools to retrieve the latest protocol specifications from
ucp.dev. This is a functional requirement for accuracy and does not involve arbitrary command execution.
Audit Metadata