shoplazza-webhook

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to interact with the shoplazza CLI tool to perform store management operations. It provides a mapping of user intents to specific CLI commands such as webhook create, webhook list, and webhook delete.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where user-supplied data, specifically webhook URLs and event topics, are interpolated into CLI commands.
  • Ingestion points: User-provided inputs for the --data and --params flags in the SKILL.md file.
  • Boundary markers: The skill explicitly instructs the agent to use AskUserQuestion if required fields are missing and to never fabricate data. It also references a common safety protocol for confirmation.
  • Capability inventory: Execution of shell-based CLI commands via the shoplazza binary.
  • Sanitization: The skill relies on the shoplazza CLI's own schema validation and the safety protocols defined in the referenced common skill to handle untrusted input.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 01:42 AM
Security Audit — agent-trust-hub — shoplazza-webhook