secure-checkout
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves an educational and defensive purpose, providing high-quality security implementations for Shopify, WooCommerce, BigCommerce, and custom Next.js storefronts. Code snippets for middleware, headers, and API routes follow industry best practices.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The code examples correctly demonstrate using environment variables (
process.env.STRIPE_SECRET_KEY,process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY) to manage secrets. - [INDIRECT_PROMPT_INJECTION]: The skill explicitly addresses the risk of processing untrusted data from external sources (such as product descriptions from a CMS). It provides specific, effective mitigations including server-side validation with Zod and HTML sanitization with DOMPurify.
- [DATA_EXFILTRATION]: No malicious exfiltration patterns were detected. The skill provides an implementation for a CSP violation reporting endpoint (
/api/csp-report) specifically designed to detect and alert on unauthorized script execution or data exfiltration attempts by third parties. - [REMOTE_CODE_EXECUTION]: The skill references well-known and trusted third-party services (Stripe, Cloudflare, Snyk) for their intended security purposes and does not contain any suspicious remote code execution or unverified dependency downloads.
Audit Metadata