moyasar
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides detailed documentation and implementation logic for the Moyasar payment gateway. It emphasizes critical security practices, including the use of environment variables for secret keys, server-side payment verification to prevent tampering, and the use of idempotency keys (given_id) to avoid double charges.
- [DATA_EXPOSURE]: The skill includes clear warnings against including secret keys (sk_*) in frontend code or version control, promoting secure secret management patterns.
- [EXTERNAL_DOWNLOADS]: The skill references legitimate, version-pinned CSS and JS assets from JSDelivr for the Moyasar Form, which is a standard and expected practice for integrating this payment gateway.
- [INDIRECT_PROMPT_INJECTION]: While the skill handles external data (payment IDs and statuses from redirects and webhooks), it provides robust mitigation patterns, including mandatory server-side re-fetching of payment data using secret keys and constant-time secret token comparison for webhooks.
Audit Metadata