mercadopago-integration

skills-sh:martinacostadev_mercadopago-integration__mercadopago-integration

View source

75/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

Score

75/100

CRITICAL 1

Findings (1)

CRITICAL

Text combines credential access with network transmission NLP_CRED_EXFIL_COMBO

exfiltration L121

Text combines credential access with network transmission

The generated webhook handler includes HMAC-SHA256 verification using MercadoPago's x-signature header and the MERCADOPAGO_WEBHOOK_SECRET environment variable. This prevents unauthorized actors from c...

FIX

Remove the combination of credential access and network transmission from the tool. If the tool needs credentials, access them via a secrets manager and never transmit them externally.

FP?

Likely FP if the tool legitimately uses credentials for API authentication (e.g., reading an API key to make authenticated requests to the same service).