salla-shipping-app
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides guidance for building applications that process external, untrusted data from the Salla ecosystem.
- Ingestion points:
SKILL.mdandreferences/shipment-cycle.mddescribe handlingcontext.payload.data, which contains user-provided order and shipment information. - Boundary markers: The skill instructs developers to confirm field names against
.d.tstype definitions and utilize the structuredShipmentbuilder SDK. - Capability inventory: The skill uses
salla_functions,salla_apps, andsalla_shippingtools to manage code and configuration. - Sanitization: The documentation repeatedly warns against logging PII (names, phones, addresses) and sensitive secrets (tokens, keys).
- [DYNAMIC_EXECUTION]: The skill involves the generation and deployment of serverless code (App Functions) to the Salla platform via the
salla_functions action=savetool. This is a documented platform feature for extending shipping functionality.
Audit Metadata