salla-app-functions-handler
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical guide for writing Salla App Functions within a restricted V8 sandbox. It explicitly prohibits the use of external packages and sensitive Node.js core modules like 'child_process' or 'fs', aligning with least-privilege security principles.- [DATA_EXFILTRATION]: The instructions include proactive security measures for outbound networking. It mandates the use of 'AbortController' to bound 'fetch' requests within strict time limits and explicitly warns developers to never log sensitive credentials or tokens from the 'context.settings' object.- [PROMPT_INJECTION]: The skill identifies the surface area for indirect prompt injection by documenting how the agent processes untrusted data from 'context.payload.data'. It provides mitigation strategies by requiring developers to validate payload shapes against authoritative type definitions and to sanitize merchant-controlled inputs before incorporating them into outbound requests.
Audit Metadata