hitpay
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with official HitPay API endpoints and utilizes the
qrcodeNode.js package. Evidence includes API calls toapi.hit-pay.comandapi.sandbox.hit-pay.cominSKILL.mdand reference files. - [COMMAND_EXECUTION]: The
scripts/verify-webhook.shfile contains shell commands used to display implementation samples. Evidence: Use ofcatto print boilerplate code for webhooks. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external API responses and webhooks. 1. Ingestion points: Webhook payloads in
app/api/webhooks/hitpay/route.ts. 2. Boundary markers: Documentation for HMAC-SHA256 signature verification. 3. Capability inventory: Usesfetchfor network communication. 4. Sanitization: Implements cryptographic signature validation to ensure data integrity.
Audit Metadata