ucoz-shop-optimizer-skill
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a secure connection model by retrieving credentials from the ucoz-mcp server context, avoiding the risks associated with hardcoded secrets or manual key entry.
- [SAFE]: A robust safety mechanism known as the 'Scope Gate' is enforced, requiring the agent to confirm the specific work scope with the user before performing any modifications to products or categories.
- [SAFE]: Sensitive shop data, including product prices, stock levels, and order statuses, are protected by default, ensuring that the agent does not alter business-critical information without explicit authorization.
- [PROMPT_INJECTION]: The skill's functionality includes auditing shop data, which creates a surface for indirect prompt injection. 1. Ingestion points: The agent reads product names, descriptions, and customer comments from the uAPI endpoints. 2. Boundary markers: The skill does not use specific delimiters to isolate external data. 3. Capability inventory: The agent has the authority to update site templates, product cards, and order fields. 4. Sanitization: The risk is addressed by instructing the agent to present a 'change plan' and wait for explicit user approval before applying any modifications derived from the analyzed content.
Audit Metadata