salla-checkout-sdk-purchase
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data via webhooks but implements appropriate defenses.
- Ingestion points: The app.checkout.paid webhook payload described in references/webhook-and-fulfilment.md.
- Boundary markers: Explicit instructions to use verifySallaSignature and check scopes before processing.
- Capability inventory: File-write and state-change operations such as database updates and credit granting.
- Sanitization: Requirement to verify payment status and amounts server-side via official API calls rather than trusting client-side responses.
- [EXTERNAL_DOWNLOADS]: The skill utilizes official vendor resources including the @salla.sa/embedded-sdk package and the api.salla.dev administrative API. These are legitimate and necessary for the skill functionality.
- [COMMAND_EXECUTION]: The instructions involve the use of platform tools like salla_scopes and salla_apps to manage application permissions and webhook configurations within the Salla ecosystem.
Audit Metadata