pci-compliance
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a pedagogical resource for PCI DSS compliance, providing valid security advice such as data minimization, tokenization, and encryption.
- [CREDENTIALS_UNSAFE]: The code uses standard placeholders for API keys (e.g., 'sk_...', 'pk_...') and test card numbers, which do not represent a credential exposure risk.
- [EXTERNAL_DOWNLOADS]: References to the 'stripe' library and well-known Python frameworks ('flask', 'cryptography') are standard for the described use case and point to official, well-known services.
- [INDIRECT_PROMPT_INJECTION]: The skill manages the attack surface of payment data ingestion (identified in 'SKILL.md') through sanitization logic ('sanitize_log'), validation ('validate_card_number'), and restricted capabilities (no arbitrary execution or exfiltration), resulting in a safe configuration.
Audit Metadata