portaly-product

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEDATA_EXFILTRATIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill reports its installed version to the vendor's API (https://portaly.ai/api/creator-subscription/skill-version). This telemetry includes the skill name and version number, authenticated via the user's API key. This is a standard vendor resource operation intended for dashboard synchronization and update notifications.
  • [DYNAMIC_EXECUTION]: The package includes utility scripts in Node.js, Python, and Go to assist users in implementing secure webhook signature verification. It also provides a test runner script (check_callback_vectors.mjs) that spawns subprocesses to validate these implementations against production-derived test vectors.
  • [COMMAND_EXECUTION]: The documentation provides shell commands for opening registration pages and running validation scripts, which are used to facilitate the integration and testing process.
  • [SAFE]: The skill implements strong security guardrails, such as advising against hardcoding secrets, requiring .env files to be ignored by version control, and mandating HMAC-SHA256 signature verification for all incoming webhooks to prevent spoofing and unauthorized data injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 09:13 AM