newebpay-refund
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements payment refund functionality using official NewebPay API endpoints (ccore.newebpay.com and core.newebpay.com). These are well-known services and their inclusion is necessary for the skill's primary purpose.
- [SAFE]: Sensitive information such as Merchant IDs, Hash Keys, and Hash IVs are managed via environment variables (e.g., NEWEBPAY_HASH_KEY) rather than being hardcoded, which aligns with secure development practices.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by ingesting user input via the $ARGUMENTS variable to determine refund parameters in SKILL.md. However, this is used for legitimate configuration purposes and no malicious exploitation patterns were found.
- Ingestion points: $ARGUMENTS variable in SKILL.md.
- Boundary markers: None explicitly defined for the interpolation of user arguments.
- Capability inventory: The skill uses Write, Edit, and Bash tools to generate project files; the resulting code performs network requests to NewebPay APIs.
- Sanitization: No specific sanitization or validation of input arguments is described in the instructions.
Audit Metadata