portaly-affiliate
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's official domains,
portaly.aiandportaly.cc, to configure promotion settings and validate account status. These requests are standard for integrating with the Portaly platform. - [COMMAND_EXECUTION]: A local diagnostic script,
scripts/check_promotion_setup.mjs, is provided to perform preflight checks. It reads the API key from the environment to safely verify product eligibility without hardcoding credentials. - [DATA_EXFILTRATION]: The skill reports its version to the vendor's API along with the merchant's authentication token. This telemetry is a documented feature designed to help users identify outdated skill installations via their vendor dashboard.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses, such as product plan names and exclusion messages, to provide feedback to the creator. The logic focuses on using this data for informative purposes within a controlled setup workflow.
Audit Metadata