payment-integration
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches and recommends the installation of integration libraries from the official GitHub repositories of SePay and Polar, as well as standard package registries (NPM, PyPI, and Composer). These downloads are necessary for the skill's primary purpose of payment platform integration.
- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for data-driven attacks by ingesting and processing untrusted payment notification data (webhooks).
- Ingestion points: The scripts
scripts/sepay-webhook-verify.jsandscripts/polar-webhook-verify.jsprocess external webhook payloads provided via command-line arguments. - Boundary markers: The scripts implement JSON parsing and cryptographic signature verification (HMAC-SHA256) to ensure data authenticity before processing.
- Capability inventory: The skill's capabilities include transaction processing logic, QR code generation, and the generation of cURL commands for API interaction.
- Sanitization: The skill includes robust verification logic for webhook signatures and validates payload structures, mitigating the risk of processing malicious data from unverified sources.
Audit Metadata