payment-gateway-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access behaviors were detected. The skill serves as a reference for secure payment integration using official SDKs.
- [INDIRECT_PROMPT_INJECTION]: The skill implements webhook handlers that ingest untrusted data from external payment providers.
- Ingestion points: Webhook endpoints in
references/nodejsexpress-stripe-integration.mdandreferences/stripe-integration-with-pythonflask.mdreceive POST payloads from external sources. - Boundary markers: Not present, which is standard for structured JSON API endpoints.
- Capability inventory: The handlers are designed to update database records (orders and subscriptions) and interact with payment provider APIs.
- Sanitization: The provided code examples follow best practices by using the official Stripe SDK to verify the
Stripe-Signatureheader against a shared secret. This cryptographic verification ensures the payload's integrity and authenticity, effectively mitigating risks associated with untrusted data ingestion.
Audit Metadata