configure-agent-commerce
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external commerce artifacts including payment proofs, mandates, and manifests, which presents an attack surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context via HTTP headers (e.g., PAYMENT-SIGNATURE), JSON request bodies in 402 responses, and well-known discovery documents (/.well-known/ucp).
- Boundary markers: The instructions require signature verification and strict schema validation for all commerce-related inputs to identify and isolate external content.
- Capability inventory: The skill employs tools such as read_file, write_file, create_file, edit_file, and fetch to manage protocol handlers and discovery surfaces.
- Sanitization: The skill implements defense-in-depth through ASI05 (strict schema validation) and ASI07 (mandatory signature verification at boundaries) to ensure that external content does not lead to unauthorized actions.
- [SAFE]: The skill adheres to security best practices by explicitly prohibiting the logging or exposure of sensitive payment credentials and requiring the redaction of restricted fields.
- [SAFE]: The instructions incorporate comprehensive security guardrails based on OWASP ASI principles, specifically addressing identity verification, supply chain safety, and execution-time authorization.
Audit Metadata