salla-webhooks
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection as it facilitates the ingestion of untrusted external data via Salla webhook payloads.\n
- Ingestion points: Webhook receiver routes (e.g.,
app.post("/webhooks/salla", ...)) inSKILL.mdand reference files.\n - Boundary markers: While signature verification is emphasized, the skill does not specify the use of delimiters or warnings to ignore instructions embedded in the payload data.\n
- Capability inventory: The skill describes event handlers that perform actions like token management and order processing based on payload data.\n
- Sanitization: The provided examples do not include explicit sanitization of the untrusted payload contents before processing.\n- [EXTERNAL_DOWNLOADS]: The skill directs users to install official vendor packages including
@salla.sa/webhooks-actionsand@salla.sa/cli.\n- [COMMAND_EXECUTION]: The official@salla.sa/webhooks-actionspackage implements a file-based routing mechanism that dynamically loads handler files from the local file system usingrequire()based on event names.
Audit Metadata