shoplazza-webhook
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to interact with the
shoplazzaCLI tool to perform store management operations. It provides a mapping of user intents to specific CLI commands such aswebhook create,webhook list, andwebhook delete. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where user-supplied data, specifically webhook URLs and event topics, are interpolated into CLI commands.
- Ingestion points: User-provided inputs for the
--dataand--paramsflags in theSKILL.mdfile. - Boundary markers: The skill explicitly instructs the agent to use
AskUserQuestionif required fields are missing and to never fabricate data. It also references a common safety protocol for confirmation. - Capability inventory: Execution of shell-based CLI commands via the
shoplazzabinary. - Sanitization: The skill relies on the
shoplazzaCLI's own schema validation and the safety protocols defined in the referenced common skill to handle untrusted input.
Audit Metadata