paddle-usage-based-billing
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Recommends installing the official
@paddle/paddle-node-sdkand thetsxutility for executing TypeScript scripts. These are standard development tools relevant to the skill's purpose. - [COMMAND_EXECUTION]: Provides shell commands for running setup and verification scripts (e.g.,
node --env-file=.env.local --import tsx scripts/setup-usage-billing.ts). These commands are intended for the developer to execute during integration. - [DATA_EXPOSURE]: Includes instructions for managing sensitive API keys. It explicitly warns developers to keep the
PADDLE_API_KEYon the server-side and never expose it to the browser, which aligns with security best practices for billing integrations. - [INDIRECT_PROMPT_INJECTION]: The skill implements a webhook handler that processes external data from Paddle. It identifies the intake points for this data and performs standard logic to update local caches based on the incoming events, presenting a standard and low-risk attack surface.
Audit Metadata