paddle-catalog-setup
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official '@paddle/paddle-node-sdk' package from the public npm registry to facilitate API interactions.
- [COMMAND_EXECUTION]: Executes generated JavaScript code snippets via the Paddle MCP 'execute' tool and provides instructions for running a local setup script using 'npx tsx'. These operations are confined to the vendor's API and the user's local development environment.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by processing external data. 1. Ingestion points: User-provided product and price metadata such as names, descriptions, and unit amounts. 2. Boundary markers: Absent. 3. Capability inventory: Includes the ability to create and list products and prices via MCP tools ('execute', 'search') and the Node.js SDK. 4. Sanitization: Not explicitly implemented; however, the skill follows a 'confirm with user first' policy for all ingested data, mitigating the risk of accidental obedience.
Audit Metadata