wc-stripe-link-payments
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides comprehensive and security-conscious documentation for the WooCommerce Stripe Gateway. It specifically includes defensive programming advice to prevent common vulnerabilities, such as validating token ownership and avoiding the use of sensitive identifiers for authorization.\n- [INDIRECT_PROMPT_INJECTION]: The skill identifies and provides mitigation for an indirect prompt injection surface inherent in payment processing integrations.\n
- Ingestion points: Untrusted data enters via Stripe PaymentMethod objects and customer-submitted token IDs referenced in
SKILL.mdandreferences/link-contract.md.\n - Boundary markers: The guidance suggests using provider-specific Woo token classes and explicit user-ownership checks to delimit data trust.\n
- Capability inventory: The skill describes logic but contains no scripts with subprocess calls, file-write operations, or network requests.\n
- Sanitization: The instructions explicitly mandate
sanitize_email(),absint(), and server-side verification of PaymentMethod state before execution.
Audit Metadata