verifier-web
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local development and environment management commands, including
docker,curl,uv, andstripe. These commands are used to manage the local stack, poll for service readiness, and facilitate testing workflows. - [EXTERNAL_DOWNLOADS]: The skill mentions installing the Stripe CLI, a well-known service, when performing payment verification. This is standard behavior for developers integrating with Stripe's testing environment.
- [CREDENTIALS_UNSAFE]: The instructions guide the user to store sensitive information like Stripe API keys in a local configuration file (
~/.config/polar/secrets.env). This follows standard development best practices for secret management and avoids hardcoding credentials within the skill itself. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it drives a browser and reads application logs. However, within the context of a local development verification tool for a specific repository, this risk is minimal and consistent with the skill's intended purpose.
Audit Metadata