sales-checkoutpage
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install an MCP server from the platform's official domain:
https://mcp.checkoutpage.com. This is a vendor-owned resource used for legitimate platform integration. - [COMMAND_EXECUTION]: Provides example CLI commands for the user to execute, including
curlfor API testing andclaude mcp addfor tool installation. These commands are intended for the user's manual configuration of the service. - [DATA_EXFILTRATION]: Documents network requests directed to the platform's official REST API (
api.checkoutpage.com). These operations are used for data synchronization and verification tasks as part of the skill's primary function. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources, specifically
conversionwebhooks and form submissions which may contain untrusted user-supplied content. - Ingestion points: Webhook listeners and form submission processing logic described in
references/platform-guide.mdandreferences/checkoutpage-api-reference.md. - Boundary markers: None explicitly defined in the provided code recipes, although the expected data format is structured JSON.
- Capability inventory: The associated MCP tools include capabilities to create checkout pages, forms, and coupons, and to upload files to the account.
- Sanitization: The skill mitigates risks by explicitly instructing the agent to re-verify all data received via webhooks by fetching the records directly from the official REST API before performing any provisioning or financial actions.
Audit Metadata