launch-booking-payments
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by explicitly instructing never to trust client-side data (prices or success statuses) and providing correct implementations for webhook signature verification using HMAC SHA-256 and
timingSafeEqual. - [DATA_EXPOSURE]: No hardcoded secrets were found. The skill correctly references environment variables (e.g.,
CAL_WEBHOOK_SECRET,STRIPE_SECRET_KEY) for sensitive credentials, which is the standard safe practice for secret management. - [COMMAND_EXECUTION]: The provided code snippets use standard, well-known libraries (
stripe,zod,node:crypto) to perform their tasks with no evidence of arbitrary or dangerous command execution.
Audit Metadata