creator-paywall
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a secure authentication flow using Sign-In With Ethereum (SIWE), ensuring that user identities are cryptographically verified via their EVM wallets.
- [SAFE]: Payment verification logic in
src/payments.jsfollows best practices by checking transaction confirmations, recipient addresses, and ensuring the sender matches the logged-in user to prevent fraud. - [COMMAND_EXECUTION]: The
scripts/init.shscript automates the setup of a new paywall instance. It performs local file operations (copying templates, writing configuration) and installs dependencies via npm. These operations are standard for development scaffolding tools and do not involve untrusted remote sources. - [CREDENTIALS_UNSAFE]: The skill handles session security correctly by providing instructions to set a unique
JWT_SECRETand automatically generating a random secret during the initialization process if one is not provided. - [EXTERNAL_DOWNLOADS]: Dependencies listed in
package.jsonare standard, well-known libraries (Express, Viem, better-sqlite3) used for building web and blockchain applications.
Audit Metadata