payment-provider-router
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides architecturally sound guidance for handling payment events. It correctly prioritizes webhook signature verification as a prerequisite, ensuring that the system only processes authentic data from the payment provider.
- [INDIRECT_PROMPT_INJECTION]: This category evaluates the surface for external data ingestion.
- Ingestion points: Stripe webhook data in
app/api/webhooks/stripe/route.ts. - Boundary markers: Explicit dependency on
stripe-webhook-signature-verificationand mandatoryconstructEventcheck. - Capability inventory: Internal dispatch to handlers for provisioning and revocation.
- Sanitization: Authentication of the payload via HMAC signature verification.
Audit Metadata