harmonyos-iap-integration
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a structured implementation guide for HarmonyOS In-App Purchase Kit, including client-side ArkTS code and server-side implementations in Java, Go, Python, Node.js, and PHP.
- [EXTERNAL_DOWNLOADS]: All external references point to official Huawei developer documentation and official sample repositories on GitCode. These are standard resources for HarmonyOS development.
- [DATA_EXFILTRATION]: Network communication in the provided examples is restricted to official Huawei IAP API endpoints. The use of JWS (JSON Web Signature) for verifying payment data from the server is a recommended security measure to prevent tampering.
- [CREDENTIALS_UNSAFE]: The code templates use clear placeholders for authentication credentials (like private key paths and issuer IDs), guiding the developer to provide their own configuration without exposing actual secrets.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes external payment data, it includes robust verification logic (JWS decoding and signature validation) to ensure the integrity of the data handled by the agent.
Audit Metadata