brazilian-financial-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate code templates for financial integrations. No malicious patterns, prompt injections, or unauthorized data exfiltration were detected. It interacts with official Banco do Brasil API domains for legitimate payment processing and does not hardcode any sensitive credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (payer information, tax IDs) that is subsequently sent to external banking APIs. While this creates a potential surface for indirect prompt injection, it is mitigated by validation logic and is intrinsic to the skill's primary purpose.
- Ingestion points:
BoletoCreateRequestandPixCobrancaRequestobjects in the FastAPI endpoint examples withinSKILL.md. - Boundary markers: No explicit delimiters or instruction-ignore warnings are present in the code snippets for user-provided string fields.
- Capability inventory: Performs network operations via
httpxto Banco do Brasil's API (api.bb.com.br) and handles file-like byte streams for PDF generation. - Sanitization: Implements strict validation and character stripping (regex-based cleaning) for CPF and CNPJ tax identification numbers.
Audit Metadata