israeli-shipping-manager
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (Israeli address fields) which are then used as parameters for local script execution and suggested external API interactions.
- Ingestion points: User-provided address fields (street, city, house number, etc.) are ingested in Step 2 to be formatted and validated.
- Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" markers for the user-supplied address components.
- Capability inventory: The skill uses the
Bashtool to execute the localscripts/format_address.pyand suggests usingWebFetchfor interacting with various carrier APIs (e.g., Datalogics, UPS Developer Kit, LionWheel). - Sanitization: The included
scripts/format_address.pyscript performs Hebrew text normalization by removing niqqud (vowel diacritics) and validates that the Mikud (ZIP code) matches the mandatory 7-digit pattern before formatting the final output.
Audit Metadata