mobile-checkout
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official Dodo Payments libraries for React Native, Flutter, iOS, and Android. These dependencies are hosted on standard registries (NPM, pub.dev, Maven) and the official GitHub repository of the vendor.
- [CREDENTIALS_UNSAFE]: The documentation includes a dedicated section on common mistakes, explicitly warning against hardcoding API keys in the client-side code and instructing developers to use backend environment variables for secret management.
- [COMMAND_EXECUTION]: The skill provides standard installation commands for mobile development, such as
npm install, and configuration examples for Gradle and CocoaPods required for SDK setup. - [INDIRECT_PROMPT_INJECTION]: The skill defines a flow where external data (checkout URLs) is processed by the agent to initiate payment flows. The implementation uses secure system browser contexts (SFSafariViewController/Chrome Custom Tabs) and mandates server-side verification via webhooks or API calls to confirm payment authenticity.
Audit Metadata