skills/polarsource/polar/verifier-web/Gen Agent Trust Hub

verifier-web

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local development and environment management commands, including docker, curl, uv, and stripe. These commands are used to manage the local stack, poll for service readiness, and facilitate testing workflows.
  • [EXTERNAL_DOWNLOADS]: The skill mentions installing the Stripe CLI, a well-known service, when performing payment verification. This is standard behavior for developers integrating with Stripe's testing environment.
  • [CREDENTIALS_UNSAFE]: The instructions guide the user to store sensitive information like Stripe API keys in a local configuration file (~/.config/polar/secrets.env). This follows standard development best practices for secret management and avoids hardcoding credentials within the skill itself.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it drives a browser and reads application logs. However, within the context of a local development verification tool for a specific repository, this risk is minimal and consistent with the skill's intended purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 12:47 PM
Security Audit — agent-trust-hub — verifier-web