snippe-integration
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides legitimate technical documentation and code templates for integrating with the Snippe Payment API.
- [SAFE]: Security best practices are strongly advocated, including the use of HMAC-SHA256 signature verification for incoming webhooks, the application of constant-time string comparisons (e.g.,
crypto.timingSafeEqual,hmac.compare_digest) to mitigate timing attacks, and the validation of timestamps to prevent replay attacks. - [EXTERNAL_DOWNLOADS]: The skill references documentation resources hosted on
snippe.shandapi.snippe.sh. These URLs are consistent with the skill's purpose as a developer tool for the Snippe payment service. - [SAFE]: Secret management is handled according to best practices, with the skill using placeholders for API keys and recommending the use of environment variables for storing production secrets.
Audit Metadata