payment-provider-framework
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: No unauthorized remote code execution patterns were detected. The skill recommends installing official VTEX packages (
@vtex/payment-provider,@vtex/api) and standard development dependencies through established package managers. - [DATA_EXFILTRATION]: The skill instructions do not contain exfiltration patterns. It provides clear guidance on using the VTEX Secure Proxy for card-related transactions to keep sensitive data within controlled environments and emphasizes the correct handling of credentials via affiliation headers.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets were found. The skill describes the mechanism for accessing dynamic credentials (API keys and tokens) through the platform's standard context.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing payment requests from external sources. While this presents an ingestion surface for untrusted data, the skill mandates using the official
PaymentProviderframework which provides structured data handling and explicitly enforces security boundaries via Secure Proxy and allowlisted destinations. - [SAFE]: The skill uses vendor-appropriate resources and practices consistent with the developer's stated infrastructure requirements (VTEX IO builder-hub constraints).
Audit Metadata