Agent skill · Audited from source
payment-integration
skill · mrgoonie/claudekit-skillsLicence not declaredAudited 31 Oct 2026 · source d655ab03f566
★ 2,230pushed 211 days agoversion 2.2.0
Is it safe? With care — CAUTION, grade B (85/100). We read this skill's source at commit d655ab03f566 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 11 findings, 0 critical or high. What it does: Integrate payments with SePay (VietQR), Polar, Stripe, Paddle (MoR subscriptions), Creem.io (licensing). Checkout, webhooks, subscriptions, QR codes, multi-provider orders.
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “payment-integration (mrgoonie/claudekit-skills)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/mrgoonie/payment-integration
Trust audit
Audit 0.4.1 · source read 31 Oct 2026
Trust score85/100!CAUTION B
0 critical0 high5 medium4 low2 info
CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | WARN | 5 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 6 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (11)
MEDIUMInventory / provenanceinv.symlink · plugins/ai-ml-tools/skills/ai-multimodal
F-13 Inventory / provenanceCWE-1104Layer L0
plugins/ai-ml-tools/skills/ai-multimodal
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · plugins/ai-ml-tools/skills/context-engineering
F-13 Inventory / provenanceCWE-1104Layer L0
plugins/ai-ml-tools/skills/context-engineering
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · plugins/ai-ml-tools/skills/google-adk-python
F-13 Inventory / provenanceCWE-1104Layer L0
plugins/ai-ml-tools/skills/google-adk-python
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · plugins/backend-tools/skills/backend-development
F-13 Inventory / provenanceCWE-1104Layer L0
plugins/backend-tools/skills/backend-development
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · plugins/backend-tools/skills/better-auth
F-13 Inventory / provenanceCWE-1104Layer L0
plugins/backend-tools/skills/better-auth
- Why
- link not followed
- Fix
- —
LOWPrompt injectionprompt.transfer_instruction · references/sepay/overview.md:62
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
POST https://my.sepay.vn/oauth/token
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · references/sepay/overview.md:73
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
POST https://my.sepay.vn/oauth/token
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionreview.instruction_override · README.md
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Claude Code will automatically activate this skill when you mention payment integration, subscriptions, webhooks, or platform-specific terms
- Why
- The skill claims automatic activation and instructs that the agent should do so when triggered by keywords, steering the agent away from normal user-directed operation without confirming user intent.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWPrivilege escalation / persistencereview.unsafe_action · README.md
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L2
node sepay-webhook-verify.js '{"id":12345,"gateway":"Vietcombank",...}'- Why
- The documentation directs agents to execute Node scripts that process webhook payloads, allowing unreviewed handling of secret data without explicit user confirmation.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
INFOPrompt injectionprompt.authority_framing · references/creem/api.md:27
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
description: 'Full access to all features',
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · references/sepay/overview.md:37
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
**Note:** All tokens have full access (no permission levels currently)
- Why
- No further detail recorded for this rule.
- Fix
- —
Audit 0.4.1 · source sha d655ab03f566 · 31 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishermrgoonie GitHub userOwner of the repository this skill is read from
- Source foldermrgoonie/claudekit-skills/.claude/skills/payment-integrationThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdictd655ab03f566A new audit runs when the source changes
- Repository statusNot archivedLast push 211 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Integrate payments with SePay (VietQR), Polar, Stripe, Paddle (MoR subscriptions), Creem.io (licensing). Checkout, webhooks, subscriptions, QR codes, multi-provider orders.
--- name: payment-integration description: Integrate payments with SePay (VietQR), Polar, Stripe, Paddle (MoR subscriptions), Creem.io (licensing). Checkout, webhooks, subscriptions, QR codes, multi-provider orders. version: 2.2.0 license: MIT --- # Payment Integration Production-proven payment processing with SePay (Vietnamese banks), Polar (global SaaS), Stripe (global infrastructure), Paddle (MoR subscriptions), and Creem.io (MoR + licensing). ## When to Use - Payment gateway integration (checkout, processing) - Subscription management (trials, upgrades, billing) - Webhook handling (notifications, idempotency) - QR code payments (VietQR, NAPAS) - Software licensing (device activation) - Multi-provider order management - Revenue splits and commissions ## Platform Selection | Platform | Best For | |----------|----------| | **SePay** | Vietnamese market, VND, bank transfers, VietQR | | **Polar** | Global SaaS, subscriptions, automated benefits (GitHub/Discord) | | **Stripe** | Enterprise payments, Connect platforms, custom checkout | | **Paddle** | MoR subscriptions, global tax compliance, churn prevention | | **Creem.io** | MoR + licensing, revenue splits, no-code checkout | ## Quick Reference ### SePay - `references/sepay/overview.md` - Auth, supported banks - `references/sepay/api.md` - Endpoints, transactions - `references/sepay/webhooks.md` - Setup, verification - `references/sepay/sdk.md` - Node.js, PHP, Laravel - `references/sepay/qr-codes.md` - VietQR generation - `references/sepay/best-practices.md` - Production patterns ### Polar - `references/polar/overview.md` - Auth, MoR concept - `references/polar/products.md` - Pricing models - `references/polar/checkouts.md` - Checkout flows - `references/polar/subscriptions.md` - Lifecycle management - `references/polar/webhooks.md` - Event handling - `references/polar/benefits.md` - Automated delivery - `references/polar/sdk.md` - Multi-language SDKs - `references/polar/best-practices.md` - Production patterns ### Stripe - `references/stripe/stripe-best-practices.md` - Integration design - `references/stripe/stripe-sdks.md` - Server SDKs - `references/stripe/stripe-js.md` - Payment Element - `references/stripe/stripe-cli.md` - Local testing - `references/stripe/stripe-upgrade.md` - Version upgrades - External: https://docs.stripe.com/llms.txt ### Paddle - `references/paddle/overview.md` - MoR, auth, entity IDs - `references/paddle/api.md` - Products, prices, transactions - `references/paddle/paddle-js.md` - Checkout overlay/inline - `references/paddle/subscriptions.md` - Trials, upgrades, pause - `references/paddle/webhooks.md` - SHA256 verification - `references/paddle/sdk.md` - Node, Python, PHP, Go - `references/paddle/best-practices.md` - Production patterns - External: https://developer.paddle.com/llms.txt ### Creem.io - `references/creem/overview.md` - MoR, auth, global support - `references/creem/api.md` - Products, checkout sessions - `references/creem/checkouts.md` - No-code links, storefronts - `references/creem/subscriptions.md` - Trials, seat-based - `references/creem/licensing.md` - Device activation - `references/creem/webhooks.md` - Signature verification - `references/creem/sdk.md` - Next.js, Better Auth - External: https://docs.creem.io/llms.txt ### Multi-Provider - `references/multi-provider-order-management-patterns.md` - Unified orders, currency conversion ### Scripts - `scripts/sepay-webhook-verify.js` - SePay webhook verification - `scripts/polar-webhook-verify.js` - Polar webhook verification - `scripts/checkout-helper.js` - Checkout session generator ## Key Capabilities | Platform | Highlights | |----------|------------| | **SePay** | QR/bank/cards, 44+ VN banks, webhooks, 2 req/s | | **Polar** | MoR, subscriptions, usage billing, benefits, 300 req/min | | **Stripe** | CheckoutSessions, Billing, Connect, Payment Element | | **Paddle** | MoR, overlay/inline checkout, Retain (churn prevention), tax | | **Creem.io** | MoR, licensing, revenue splits, no-code checkout | ## Implementation See `references/implementation-workflows.md` for step-by-step guides per platform. **General flow:** auth → products → checkout → webhooks → events
Excerpt, first 4,198 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit d655ab0
npm install creem pip install creem npm install creem_io npm install @creem/nextjs npm install @creem/better-auth git clone https://github.com/creem-io/nextjs-template
git clone https://github.com/mrgoonie/claudekit-skills git -C claudekit-skills checkout d655ab03f566
Commands as the repository documents them: shown, never run by us. Our verdict covers commit d655ab03f566 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
| Windsurf | Mentioned in its text, not tested | Skills for Windsurf · About Windsurf |
Audit history
Every audit, every source change
- !CAUTION B 85 / 100
first audit · source
d655ab03f566
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/mrgoonie/payment-integration/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
Engineering!CAUTION
alirezarezvani/claude-skills
380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8 more coding agents — engineering,…
★ 28kGrade B
Llm Cost Optimizer!CAUTION
alirezarezvani/claude-skills
380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8 more coding agents — engineering,…
★ 28kGrade B
Claude Coach!CAUTION
alirezarezvani/claude-skills
380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8 more coding agents — engineering,…
★ 28kGrade B
Add this badge to your README
[](https://modelsatlas.com/skills/mrgoonie/payment-integration/)
<a href="https://modelsatlas.com/skills/mrgoonie/payment-integration/"><img src="https://modelsatlas.com/skills/mrgoonie/payment-integration/badge.svg" alt="ModelsAtlas: CAUTION B"></a>
Questions about payment-integration
What does the payment-integration skill do?
All powerful skills of ClaudeKit.cc!
Is payment-integration safe to install?
With care. The audit graded it B (85/100) and found 11 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can payment-integration access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does payment-integration work with?
Its documentation mentions claude-code, cursor and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (d655ab03f566), read on 2026-10-31. The repository is watched, and a new audit runs when it changes — this is the first audit.
Sources
- github.com/mrgoonie/claudekit-skills/tree/main/.claude/skills/pa — the audited source at commit d655ab03f566 and every finding aboveObserved · 31 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the payment-integration skill do?
- Is payment-integration safe to install?
- What can payment-integration access on my machine?