plaid-nextjs-integration
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates excellent security hygiene for financial integrations.
- Credential Management: It correctly uses the
server-onlypackage inlib/plaid.tsto ensure sensitive Plaid Client IDs and Secrets are never bundled into the client-side code, preventing accidental leakage. - Data Protection: The
exchange-tokenroute and transaction sync server actions explicitly call for anencryptanddecryptutility, following the best practice of not storing financial access tokens in plain text. - Authentication & Authorization: API routes are protected using NextAuth/session checks, and the middleware implementation correctly scopes protection to the
/api/plaid/*path while explicitly exempting the webhook endpoint. - Webhook Security: The skill includes a robust implementation for verifying the
plaid-verificationheader to ensure requests originate from Plaid rather than an attacker. - Runtime Configuration: It correctly identifies and documents the need for
runtime = "nodejs"to avoid failures in Edge environments due to Node.js built-in module dependencies in the Plaid SDK.
Audit Metadata