payram-payment-integration

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install the payram and dotenv packages from NPM and clone the payram-mcp repository from the vendor's official GitHub account. These resources are necessary for the skill's functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines workflows that ingest external data, such as customer emails and IDs, to initiate payments. While this represents an attack surface common to payment integrations, the risk is mitigated by standard implementation practices described in the documentation.
  • [CREDENTIALS_UNSAFE]: The code examples demonstrate the safe handling of sensitive credentials by retrieving them from environment variables (PAYRAM_API_KEY, PAYRAM_WEBHOOK_SECRET) rather than hardcoding them.
  • [COMMAND_EXECUTION]: The documentation includes standard setup commands for cloning the vendor's repository and installing dependencies using npm and yarn.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:52 PM