pakistan-payments-stack
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides architectural guidance and implementation checklists without including executable scripts or requesting broad permissions. It focuses on the use of official documentation and secure integration workflows.\n- [EXTERNAL_DOWNLOADS]: References to external documentation are limited to official domains of the service providers and the central bank of Pakistan (sbp.org.pk, jazzcash.com.pk, easypaisa.com.pk). These are well-known services and are documented neutrally.\n- [CREDENTIALS_UNSAFE]: No hardcoded credentials or sensitive files are accessed. The skill includes explicit security requirements for using secure secret managers and separating environment-specific credentials.\n- [INDIRECT_PROMPT_INJECTION]: The skill addresses potential injection via payment provider webhooks. 1. Ingestion points: WebhookIngest component; 2. Boundary markers: Explicit requirement to verify signatures from raw request bodies; 3. Capability inventory: The skill specifies database operations on BillingDB and state management within PaymentsService; 4. Sanitization: Mandates signature verification and idempotency checks to prevent malicious or duplicate events.
Audit Metadata