salla-app-lifecycle
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is educational, providing implementation steps and reference data for Salla's webhook-driven lifecycle events. No malicious code or suspicious execution patterns were found.
- [EXTERNAL_DOWNLOADS]: The skill references official developer documentation from Salla (docs.salla.dev). These references are used for payload verification and implementation guidance.
- [DATA_EXFILTRATION]: While the skill involves the handling of sensitive OAuth tokens (access and refresh tokens), it provides explicit instructions on security best practices. It mandates encrypting tokens at rest, keeping them out of logs, and using dedicated secret management services for webhook signing secrets.
- [PROMPT_INJECTION]: The skill describes processing untrusted data from external webhooks, which theoretically presents an indirect prompt injection surface.
- Ingestion points: Salla webhook event payloads processed by the backend (SKILL.md).
- Boundary markers: The skill explicitly requires signature verification (HMAC-SHA256) as a prerequisite for processing any event.
- Capability inventory: Database upserts for merchant state and enqueuing background jobs for cleanup.
- Sanitization: Mandatory HMAC-SHA256 signature verification and payload validation against defined schemas.
Audit Metadata