discounts-and-promotions
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill exclusively uses resources and packages provided by the authoring vendor ('dodopayments'), including the dodopayments SDK and official API endpoints.- [SAFE]: Follows security best practices by recommending the use of environment variables for API keys and explicitly warning against insecure client-side validation of discount codes.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied discount codes which are treated as untrusted data.
- Ingestion points: The validateDiscount function and checkout session creation in SKILL.md take a code string.
- Boundary markers: None explicitly defined for prompt construction, but the skill emphasizes server-side validation logic.
- Capability inventory: The skill uses the dodopayments SDK to interact with financial data, create checkout sessions, and update subscription plans.
- Sanitization: The skill provides logic to validate codes against backend state (expiration, usage limits, restrictions) before processing.
Audit Metadata