dodo-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install SDKs and framework adapters from official registries such as NPM, PyPI, Maven, and others. All packages and repositories mentioned are owned by the vendor 'dodopayments' and represent standard integration steps for their service.
- [INDIRECT_PROMPT_INJECTION]: The skill describes processing external data through webhook endpoints, which constitutes a surface for processing untrusted content.
- Ingestion points: The integration example in
SKILL.mddefines a webhook listener (app.post('/webhook', ...)) that accepts raw request data. - Boundary markers: The instructions explicitly state that webhook signature verification is mandatory and warn against trusting payloads without verification.
- Capability inventory: The logic involves calling the Dodo Payments API to list payments or create sessions, and custom local functions to grant user access.
- Sanitization: The skill mandates the use of the vendor's SDK method
client.webhooks.unwrap()which performs cryptographic verification (HMAC-SHA256) of the raw request body to ensure authenticity before the data is processed.
Audit Metadata