commet
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill manages sensitive information such as API keys and webhook secrets using environment variables, minimizing the risk of credential exposure as described in SKILL.md and references/better-auth.md.
- [SAFE]: The integration documentation emphasizes the use of HMAC-SHA256 signature verification for all incoming webhooks to ensure the integrity and authenticity of external data, as shown in references/nextjs.md and references/sdk.md.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external data through webhook payloads and metadata fields.
- Ingestion points: Webhook handlers in references/nextjs.md and customer management methods in references/sdk.md.
- Boundary markers: The SDK employs structured data formats and typed interfaces to delimit external content.
- Capability inventory: Network requests for billing operations and CLI-driven configuration synchronization.
- Sanitization: Built-in verification logic for webhooks and structured schema enforcement for metadata.
Audit Metadata