pinme-uniwebpay
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill enforces strict credential management by instructing users to use Cloudflare Worker environment bindings for sensitive secrets instead of hardcoding them or committing them to version control.
- [SAFE]: Code templates for payment processing include mandatory validation for critical financial parameters such as amounts (enforcing integer minor units), currencies (ISO 4217 validation), and payment methods.
- [SAFE]: Webhook implementation logic requires raw body signature verification using the
@uniwebpay/sdkand theUNIWEB_WEBHOOK_SECRET, preventing unauthorized manipulation of payment fulfillment processes. - [SAFE]: The skill maintains clear boundaries between server-side operations and client-side code, explicitly warning against importing the payment SDK in browser-side bundles.
- [SAFE]: External dependencies are restricted to the official vendor SDK (@uniwebpay/sdk) which is directly related to the skill's primary purpose.
Audit Metadata