salla-app-functions-release
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates the management of Salla App Functions through official CLI/MCP tools (
salla_functions,app_publish). All documented actions and URLs (e.g., portal.salla.partners) are restricted to the vendor's own infrastructure. - [SAFE]: The skill explicitly incorporates security best practices by instructing the agent to perform a "Pre-publish security check." This includes scanning for hardcoded secrets, API keys, and PII before a function is submitted for publication.
- [PROMPT_INJECTION]: The skill involves processing user-authored code ("content") which is a potential surface for indirect prompt injection.
- Ingestion points: Untrusted data is retrieved via
salla_functions action=getinSKILL.md. - Boundary markers: None explicitly defined for isolating code from instructions.
- Capability inventory: The skill uses
salla_functions action=saveandaction=previewto write and execute code within the vendor environment. - Sanitization: The skill mandates a security scan for secrets and PII prior to publication. Given the developer-centric purpose and the inclusion of safety guardrails, this is assessed as a standard operational risk handled by best practices.
Audit Metadata