nodejs-payments
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill documentation follows security best practices by explicitly instructing the agent to keep secret keys server-only, avoid logging sensitive payment details, and use official SDK methods for all critical operations.- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for processing untrusted data received from external payment provider webhooks.
- Ingestion points: The skill processes raw request bodies from external webhook events (SKILL.md, references/providers.md).
- Boundary markers: Instructions mandate that the server must never trust client-supplied amounts or access levels and must verify the source before parsing data.
- Capability inventory: The agent is authorized to perform file writes, package installations (e.g., Stripe, Polar, Paddle SDKs), and API interactions.
- Sanitization: The skill requires mandatory signature verification using the provider's official libraries before any data is processed or stored in the database.- [EXTERNAL_DOWNLOADS]: The skill references official SDKs and documentation from well-known payment platforms including Stripe, Polar, and Paddle. It points to official GitHub repositories such as github.com/polarsource/polar-js and github.com/PaddleHQ/paddle-node-sdk for implementation guidance.
Audit Metadata