prava-sdk-integration
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the
@prava-sdk/coreNPM package, which is the official SDK provided by the author, Prava Payments. This represents a legitimate dependency for the skill's primary purpose. - [SAFE]: All network requests within the provided code templates target
prava.spacesubdomains. These are verified vendor-owned resources and part of the official Prava payment infrastructure. - [SAFE]: The instructions include mandatory security invariants that protect sensitive data, such as requiring the
MERCHANT_SECRET_KEYto remain strictly server-side and utilizing PCI-compliant iframes to ensure the application never processes raw card data. - [SAFE]: Environment variable examples use clearly marked placeholders (e.g.,
sk_test_YOUR_SECRET_KEY_HERE), preventing accidental exposure of real credentials during the development process.
Audit Metadata