shalom-api
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill mentions the use of an
x-api-keyandpasswordfields but correctly instructs users to provide their own values (e.g.,TU_API_KEY,secreto) rather than hardcoding sensitive information. It also properly explains secret management for webhooks. - [EXTERNAL_DOWNLOADS]: The README provides a manual installation command using
curlto fetch theSKILL.mdfromhttps://shalom-api.lat/skill/SKILL.md. This is documented as the official source for the API and is treated as a safe vendor-related resource. - [DATA_EXPOSURE]: The skill facilitates shipping tracking and agency lookup. While it handles DNI (National Identity Document) numbers for validation, these are processed via official endpoints (
/account/dni/{dni}) as part of the intended courier service functionality. - [COMMAND_EXECUTION]: The documentation provides examples of
curlcommands for API interaction. These are standard integration examples and do not involve suspicious shell execution or injection patterns.
Audit Metadata