portaly-product
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reports its installed version to the vendor's API (
https://portaly.ai/api/creator-subscription/skill-version). This telemetry includes the skill name and version number, authenticated via the user's API key. This is a standard vendor resource operation intended for dashboard synchronization and update notifications. - [DYNAMIC_EXECUTION]: The package includes utility scripts in Node.js, Python, and Go to assist users in implementing secure webhook signature verification. It also provides a test runner script (
check_callback_vectors.mjs) that spawns subprocesses to validate these implementations against production-derived test vectors. - [COMMAND_EXECUTION]: The documentation provides shell commands for opening registration pages and running validation scripts, which are used to facilitate the integration and testing process.
- [SAFE]: The skill implements strong security guardrails, such as advising against hardcoding secrets, requiring
.envfiles to be ignored by version control, and mandating HMAC-SHA256 signature verification for all incoming webhooks to prevent spoofing and unauthorized data injection.
Audit Metadata