sales-checkoutpage

Pass

Audited by Gen Agent Trust Hub on Jul 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install an MCP server from the platform's official domain: https://mcp.checkoutpage.com. This is a vendor-owned resource used for legitimate platform integration.
  • [COMMAND_EXECUTION]: Provides example CLI commands for the user to execute, including curl for API testing and claude mcp add for tool installation. These commands are intended for the user's manual configuration of the service.
  • [DATA_EXFILTRATION]: Documents network requests directed to the platform's official REST API (api.checkoutpage.com). These operations are used for data synchronization and verification tasks as part of the skill's primary function.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources, specifically conversion webhooks and form submissions which may contain untrusted user-supplied content.
  • Ingestion points: Webhook listeners and form submission processing logic described in references/platform-guide.md and references/checkoutpage-api-reference.md.
  • Boundary markers: None explicitly defined in the provided code recipes, although the expected data format is structured JSON.
  • Capability inventory: The associated MCP tools include capabilities to create checkout pages, forms, and coupons, and to upload files to the account.
  • Sanitization: The skill mitigates risks by explicitly instructing the agent to re-verify all data received via webhooks by fetching the records directly from the official REST API before performing any provisioning or financial actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 19, 2026, 04:16 PM
Security Audit — agent-trust-hub — sales-checkoutpage