sdk-integration
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to run
npx -y solvapay@latest init, which downloads and executes the SolvaPay initialization utility directly from the NPM registry to set up the SDK environment. - [COMMAND_EXECUTION]: The skill provides and requires the execution of a Node.js utility script located at
scripts/check-env.mjsto perform local security audits on the project's environment configuration. - [DATA_EXFILTRATION]: The
check-env.mjsscript accesses sensitive local files, including.env,.env.local,.env.development, and Next.js configuration files (next.config.js/mjs/ts). This access is performed strictly for local pattern matching to identify and warn the user about potential secret leaks (e.g.,SOLVAPAY_SECRET_KEY) before deployment. No data is transmitted to external servers.
Audit Metadata