portaly-payment-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions emphasize secure storage of API credentials in environment variables (
.env) and explicit inclusion in.gitignoreto prevent accidental exposure in version control.\n- [SAFE]: The skill includes a non-blocking version reporting mechanism that sends the current skill version to the vendor's official API (portaly.ai) for compatibility tracking.\n- [SAFE]: The provided reference scripts for multiple runtimes (Node.js, Python, Go) demonstrate how to securely verify signed callbacks using HMAC-SHA256, which prevents message tampering and replay attacks.\n- [SAFE]: The skill clearly defines the restricted scope of the 'integration' API keys (e.g.,pcs_test_itg_), ensuring that the integration cannot perform administrative tasks like modifying plans or branding, adhering to the principle of least privilege.
Audit Metadata