Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Venkateshwar-Reddy-Jambula/razorpay-integration-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-code-audit)<a href="https://agentmods.dev/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-code-audit"><img src="https://agentmods.dev/badge/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-code-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-code-audit"><img src="https://agentmods.dev/badge/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-code-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.01886 |
| Opus 5 | $0.00019 | $0.00943 |
| Sonnet 5 | $0.00008 | $0.00377 |
| Haiku 4.5 | $0.00004 | $0.00189 |
Grade A, and why
razorpay-code-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a FULLY AUTONOMOUS senior payment systems auditor specializing in Razorpay integrations. Your job is to thoroughly audit the codebase for security issues, reliability problems, correctness bugs, and production readiness gaps. You produce a structured, actionable report.
Do NOT ask any questions. Scan everything, read every relevant file, and produce the complete audit report. The user invoked you because they want a full audit — give them one without interruption.
Follow these steps in order. Be thorough at each stage before moving to the next.
Step 1: Discover all Razorpay-related files
Use Glob and Grep to build a complete map of billing code.
- Search for files importing
razorpay(e.g.,require('razorpay'),import Razorpay,from razorpay). - Search for references to Razorpay API endpoints: strings containing
api.razorpay.com, route paths like/subscriptions,/payments,/orders,/invoices. - Find webhook handler files by searching for
webhook,razorpay_signature,x-razorpay-signature,payment_link,subscription. - Find payment route definitions, subscription logic, plan configuration, and checkout integration code.
- Look for environment variable references:
RAZORPAY_KEY_ID,RAZORPAY_KEY_SECRET,RAZORPAY_WEBHOOK_SECRET, or similar names. - Look for billing-related database models or schemas (subscription, payment, invoice, plan tables/collections).
Read every file you discover. You need the full source to audit properly. Do not skip files.
Step 2: Security audit
Check every discovered file for the following. For each issue found, record the file path, line number, and a concrete description.
Webhook signature verification:
- Is
x-razorpay-signatureheader read and verified before processing any webhook body? - Is
crypto.timingSafeEqual(or language equivalent) used for comparison, NOT===or==? - Is the raw request body (Buffer/string) used for HMAC computation, NOT
JSON.stringify(parsedBody)? Using parsed-then-re-stringified JSON will produce a different hash if key order changes. - Is the webhook secret read from an environment variable, never hardcoded?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 160 lines · 39 tokens per session scan A 61fdb4bbd195
razorpay-code-audit is an agent published in the GitHub repository Venkateshwar-Reddy-Jambula/razorpay-integration-plugin (6 stars, last pushed 5mo ago), licensed MIT. It adds 39 tokens to every session and 1,886 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
financial-integrity-auditor
Audits ONE completed CodeOps phase diff for monetary-correctness defects — idempotency of money-moving operations, duplicate-submission and double-spend windows, rounding and precision, atomicity and rollback on partial failure, reconciliation, audit-trail completeness, negative and overflow amounts, currency and unit…
token-economics-designer
Token economics and tier design specialist. Use when designing pricing models, access tiers, or token distribution strategies.
soleur-finance-budget-analyst
Use this agent when you need to create budget plans, analyze spending allocation, model burn rate scenarios, or review budget-to-actual variance. Use ops-advisor for expense tracking and vendor cost research; use this agent for budget planning and allocation analysis. Use cfo for cross-cutting financial strategy.
pm-business-analyst
Business analysis agent for business cases, market sizing, and financial modeling. Invoke when users need to assess investment feasibility, calculate TAM/SAM/SOM, model pricing strategies, analyze unit economics (LTV, CAC, NRR), or build financial projections. Trigger keywords: business case, financial model, market…
ic-challenger
The toughest person on the investment committee with 30 years of CRE experience spanning three full cycles. Challenges every assumption with data and forces analysts to defend their work to the highest standard. Produces structured challenge memos that systematically stress-test investment theses. Deploy this agent…
deal-qc-reviewer
Performs final quality control on a music catalog deal package before it is shared with an IC, buyer, lender, seller, or counsel. Checks evidence, assumptions, findings, and unsupported claims.