payment-gateway-integration
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides implementation templates for official payment SDKs from trusted vendors (Stripe and PayPal).
- [SAFE]: Secret management follows industry best practices by utilizing environment variables (
process.env) for sensitive API keys and client secrets, avoiding hardcoded credentials. - [SAFE]: The code includes logic for verifying webhook signatures (e.g.,
stripe.webhooks.constructEvent), which is critical for preventing request spoofing and ensuring the integrity of payment notifications. - [SAFE]: The skill includes comprehensive security documentation, providing developers with clear 'Do' and 'Don't' lists and checklists to ensure PCI compliance and secure data handling.
- [SAFE]: The resource
references/paypal-integration.mdcorrectly identifies and warns about the deprecation of the@paypal/checkout-server-sdkpackage, directing users to the current maintained version.
Audit Metadata