axiom-payments
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides detailed technical documentation and implementation guidelines for Apple's payment and Wallet ecosystem, including PassKit, ProximityReader, and FinanceKitUI.
- [SAFE]: Security best practices are correctly prioritized. The skill explicitly warns against common vulnerabilities, such as performing merchant validation in the browser (which could leak identity certificates) and trusting client-supplied transaction totals (which could lead to price tampering).
- [SAFE]: The documentation includes advanced security considerations, such as mitigating Server-Side Request Forgery (SSRF) when handling merchant validation URLs by implementing strict host allowlists.
- [SAFE]: All external references target official Apple Developer resources, WWDC sessions, or well-known, trusted payment service providers (Stripe, Adyen, and Square).
- [SAFE]: No evidence of prompt injection, obfuscation, data exfiltration, or unauthorized command execution was found across the provided files.
Audit Metadata