ucp-order-management — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ucp-order-management (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
中文摘要:成单后通过 dev.ucp.shopping.order 能力管理订单——产生/消费必需的订单 webhook 事件(created/shipped/delivered),用 tracking number 跟踪履约事件,用真实字段处理调整 (cancellation/return/refund)。回答"订单到哪了"或处理售后变更时用。Begins from the order.id returned by ucp-checkout-session completion.
Capability dev.ucp.shopping.order — webhook-based order lifecycle. On Google's integration, the merchant POSTs events to Google's ingestion endpoint:
POST https://shoppingdataintegration.googleapis.com/v1/webhooks/partners/{PARTNER_ID}/events/order?key={API_KEY}
# auth: X-Goog-Api-Key: {API_KEY} (or ?key=) + signature headers
# Request-Signature / Content-Digest / Signature-Input / Signature (version-dependent)Three mandatory event types: Order created, Order shipped, Order delivered.
Order object:
{
"id": "ord_77Q…",
"checkout_id": "cs_01H…",
"created_time": "2026-06-03T12:00:00Z",
"currency": "EUR",
"line_items": [
{
"id": "li_1",
"item": { "id": "sku_8821", "title": "Trail Runner GTX", "price": 11900 },
"quantity": { "total": 2, "fulfilled": 0, "original": 2 },
"totals": [ { "type": "subtotal", "amount": 23800 } ],
"status": "confirmed"
}
],
"totals": [ { "type": "total", "amount": 28322 } ],
"fulfillment": {
"events": [
{ "id": "fe_1", "occurred_at": "2026-06-04T09:10:00Z", "type": "shipped",
"line_items": ["li_1"], "tracking_number": "DHL-XYZ",
"tracking_url": "https://dhl…/DHL-XYZ", "description": "Shipped via DHL" }
]
},
"permalink_url": "https://merchant.example/orders/ord_77Q…"
}Adjustments — type: cancellation | return | refund:
{ "id": "adj_1", "type": "refund", "description": "Returned 1 pair",
"line_items": ["li_1"], "occurred_at": "2026-06-09T10:00:00Z", "status": "completed" }occurred_at order, update the order's fulfillment.events + line quantity.fulfilled. Treat events as source of truth over cached state.
fulfillment.events entry +tracking_number/tracking_url; link permalink_url.
quantity { total, fulfilled, original }; don't report"delivered" until all units are.
type + line_items+ reason; reflect the returned status back to the user.
id, order by occurred_at, idempotent apply.return adjustment instead.line_items events; track quantity.fulfilled.adjustment.status); never fabricate."Where's my Acme order?" → then "cancel one pair."
fulfillment.events = type:shipped, tracking_number:DHL-XYZ → report + ETA.adjustment {type:"return", line_items:["li_1"]}.refund adjustment reaching status:"completed", update totals + confirm amount.ucp-checkout-session~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.