chapa-payments
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install several payment SDKs from standard registries such as NPM (chapa-nodejs, chapa-nestjs, @chapa_et/inline.js), PyPI (chapa, django-chapa), Composer (chapa/chapa-laravel), and Pub (chapasdk). These are official or community-maintained libraries for the Chapa gateway.
- [COMMAND_EXECUTION]: Utility scripts (scripts/init_test_payment.sh, scripts/verify_transaction.sh, scripts/sign_webhook.py) execute shell commands using curl and python3 to interact with the Chapa API and simulate webhook events for testing purposes. These scripts are intended for local development and smoke testing of the integration.
- [INDIRECT_PROMPT_INJECTION]: The skill documents the implementation of webhook endpoints that ingest untrusted JSON data from the network.
- Ingestion points: Webhook handlers are defined in references/webhooks.md, references/laravel.md, references/nodejs.md, references/php.md, and references/python.md which process POST requests from the Chapa gateway.
- Boundary markers: The instructions mandate the verification of the x-chapa-signature header using HMAC SHA256 and a shared secret hash to authenticate the source of the data.
- Capability inventory: These handlers are designed to perform network lookups (calling GET /v1/transaction/verify/{tx_ref}) and update local database records (marking orders as paid).
- Sanitization: The skill explicitly instructs developers to not trust the status in the webhook body alone, but to call the official verification API and compare the amount, currency, and tx_ref against their internal records before fulfilling orders.
Audit Metadata