checkout-integration
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill utilizes
process.env.DODO_PAYMENTS_API_KEYandos.environ["DODO_PAYMENTS_API_KEY"]to manage sensitive credentials, ensuring API keys are not hardcoded in the source code. - [EXTERNAL_DOWNLOADS]: The documentation suggests the installation of
dodopayments-checkout, which is a legitimate package provided by the vendor (dodopayments). - [INDIRECT_PROMPT_INJECTION]: The skill addresses the processing of untrusted user input (e.g.,
planIdandquantityfrom the frontend). It includes specific security advice and code implementations for server-side validation, such as mapping public plan names to allowlisted internal product IDs and enforcing strict type and value checks on user-provided data. - [DATA_EXPOSURE]: The guide includes security warnings against relying on client-side redirect parameters for order fulfillment, emphasizing the use of cryptographically signed webhooks for authoritative payment verification.
Audit Metadata