paypal-integration
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified in the PayPal integration skill. All code snippets represent standard, documented integration patterns.
- [EXTERNAL_DOWNLOADS]: The skill references the official PayPal JavaScript SDK (
www.paypal.com/sdk/js) and official REST API endpoints (api-m.paypal.com). These are well-known services associated with the stated functionality. - [CREDENTIALS_UNSAFE]: The skill correctly uses placeholders for sensitive information, such as
YOUR_CLIENT_IDandYOUR_CLIENT_SECRET, and avoids hardcoding any actual credentials. - [REMOTE_CODE_EXECUTION]: The provided Python and JavaScript snippets use standard libraries and frameworks (
requests,flask,paypalrestsdk). There is no evidence of unsafe remote code execution or dynamic evaluation of untrusted input. - [INDIRECT_PROMPT_INJECTION]: The skill includes implementation details for handling external data via Instant Payment Notifications (IPN). Crucially, it includes verification logic (
verify_ipn) that validates the authenticity of the data with PayPal before processing, mitigating risks from untrusted external input.
Audit Metadata