tg-stars-payments
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The test file
tests/test_stars_ledger.pyutilizessubprocess.runto execute a script that simulates a process crash. This is a controlled execution of the local Python interpreter used to verify the ledger's ability to recover pending payments after an interrupted delivery, which is a standard testing practice for durability. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process Telegram Bot API update objects. The Python scripts implement rigorous type checking and schema validation on these external inputs. Furthermore, all database interactions in
scripts/stars_ledger.pyuse parameterized queries, mitigating risk from malformed or malicious data payloads. - [DATA_EXPOSURE_&_EXFILTRATION]: The skill manages payment information within a local SQLite database. The code does not contain any hardcoded credentials or network operations that could lead to data exfiltration. The database connection logic in
scripts/stars_ledger.pyenforces the use of a file path for persistence, which aligns with security recommendations for payment processing.
Audit Metadata