app-integration
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npx -y solvapay@latest initto bootstrap project configuration and runs a local environment check script (scripts/check-env.mjs) to detect secret leaks.\n- [EXTERNAL_DOWNLOADS]: Fetches thesolvapaypackage from the NPM registry during the initialization process and recommends the installation of various SDK packages within the@solvapayvendor scope.\n- [INDIRECT_PROMPT_INJECTION]:\n - Ingestion points: Analyzes project metadata and configuration files (
package.json,.env,next.config.js) to adapt its behavior to the detected tech stack.\n - Boundary markers: Employs specific guardrails and structured handoff templates to ensure sensitive keys are managed correctly.\n
- Capability inventory: Can execute shell commands (
npx), perform local network tests (curl), and write verification artifacts to the filesystem.\n - Sanitization: Uses the
check-env.mjsscript to validate environment variables and prevent the leakage of server-side secrets into client-side code.
Audit Metadata