add-payments
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [SAFE]: The skill successfully implements a payment integration workflow without introducing security vulnerabilities.
- [EXTERNAL_DOWNLOADS]: The skill downloads the official '@polar-sh/sdk' package from a well-known service provider, which is a standard and safe practice for this integration.
- [COMMAND_EXECUTION]: The skill utilizes 'npm install' and 'npx supabase' for environment setup and database management, which are legitimate uses of the allowed tools.
- [DATA_EXFILTRATION]: The skill establishes a webhook endpoint for receiving payment notifications. It mitigates indirect prompt injection risks by verifying signatures. Ingestion point: 'src/app/api/webhooks/polar/route.ts'. Boundary markers: Not applicable as it is a code-level implementation. Capability inventory: Uses 'supabaseAdmin' for database writes. Sanitization: Employs 'validateEvent' for signature verification.
Audit Metadata