checkout-integration

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFE
Full Analysis
  • [CREDENTIALS_SAFE]: The skill utilizes process.env.DODO_PAYMENTS_API_KEY and os.environ["DODO_PAYMENTS_API_KEY"] to manage sensitive credentials, ensuring API keys are not hardcoded in the source code.
  • [EXTERNAL_DOWNLOADS]: The documentation suggests the installation of dodopayments-checkout, which is a legitimate package provided by the vendor (dodopayments).
  • [INDIRECT_PROMPT_INJECTION]: The skill addresses the processing of untrusted user input (e.g., planId and quantity from the frontend). It includes specific security advice and code implementations for server-side validation, such as mapping public plan names to allowlisted internal product IDs and enforcing strict type and value checks on user-provided data.
  • [DATA_EXPOSURE]: The guide includes security warnings against relying on client-side redirect parameters for order fulfillment, emphasizing the use of cryptographically signed webhooks for authoritative payment verification.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 05:36 AM
Security Audit — agent-trust-hub — checkout-integration