extension-payment
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads resources from well-known payment providers, including API documentation from Stripe and Polar, and the Paddle.js library from the official Paddle CDN.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external documentation and user requirements to generate implementation code.
- Ingestion points: User requirements for payment models and API documentation fetched from external providers via the docs-seeker tool.
- Boundary markers: Not present; the skill does not specify delimiters for external doc content.
- Capability inventory: Generates extension and backend source code, handles authentication via chrome.identity, and performs network operations via fetch.
- Sanitization: Explicitly recommends security measures like webhook signature validation and backend-only API key storage.
- [COMMAND_EXECUTION]: The skill suggests running standard installation commands for well-known packages, such as npm install stripe, to set up the backend environment.
Audit Metadata