payram-widget-integration
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes implementation patterns for webhook handlers that ingest and process data from external network requests.
- Ingestion points: Multiple framework examples in
SKILL.md(Express, Next.js, FastAPI, Laravel, Gin) define endpoints intended to receive JSON payloads from external POST requests. - Boundary markers: The skill explicitly instructs the user to verify the
API-Keyshared-secret header and provides code snippets utilizing constant-time comparison methods to mitigate timing attacks. - Capability inventory: The handlers invoke a
fulfilOrderfunction which represents business logic, such as database updates or order fulfillment, based on the received payment status. - Sanitization: While the examples use standard JSON parsing, they do not illustrate explicit validation or sanitization of the payload fields before they are passed to the fulfillment logic.
- [EXTERNAL_DOWNLOADS]: The integration instructions involve fetching a client-side script from the vendor's platform.
- Evidence: The HTML embed example in
SKILL.mdreferences a JavaScript file hosted athttps://payram.com/widget/payram-add-credit-v1.js.
Audit Metadata