refunds-and-disputes
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by instructing users to store sensitive API keys and webhook keys in environment variables (e.g.,
process.env.DODO_PAYMENTS_API_KEY) rather than hardcoding them in the source code. - [SAFE]: The provided webhook handling logic includes mandatory signature verification using the
client.webhooks.unwrapmethod. This ensures that the incoming data is authentic and originates from Dodo Payments, preventing potential spoofing attacks. - [EXTERNAL_DOWNLOADS]: The skill references the
dodopaymentsandexpressNode.js packages. These are standard dependencies for integrating with the vendor's API and creating a web server. - [SAFE]: All external documentation links point to official
dodopayments.comdomains, which are legitimate vendor resources.
Audit Metadata