payment-integration
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines workflows for processing untrusted external data from payment provider webhooks.
- Ingestion points: Webhook request bodies (referenced in
SKILL.md). - Boundary markers: None explicitly defined for instruction delimitation within the processed data.
- Capability inventory: The skill facilitates the creation of code for network requests, database storage, and financial transactions.
- Sanitization: The skill mitigates risks by mandating cryptographic signature verification and out-of-band server-side state validation from official provider APIs.
- [SAFE]: The skill instructions prioritize security and compliance. It explicitly forbids the handling or logging of raw credit card data and requires the use of official, tokenized SDKs to maintain PCI compliance.
Audit Metadata