laravel-billing
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection by design, as it must ingest and process untrusted data from external payment providers to manage billing states.\n
- Ingestion points: The references/templates/WebhookController.php.md file defines logic for receiving and processing JSON payloads from Stripe and Paddle webhook events.\n
- Boundary markers: No specific delimiters or instructions to ignore embedded prompts are included in the template logic for processing these external payloads.\n
- Capability inventory: The skill includes templates for database modifications in SubscriptionController.php.md and WebhookController.php.md, automated email notifications, and network operations via the integrated Stripe and Paddle SDKs.\n
- Sanitization: The implementation relies on the Laravel framework's standard Eloquent ORM for database interaction security. It utilizes webhook signature verification to ensure the authenticity of the data source, though it does not perform deep validation of the payload content beyond this check.
Audit Metadata