Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Venkateshwar-Reddy-Jambula/razorpay-integration-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-diagnostics)<a href="https://agentmods.dev/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-diagnostics"><img src="https://agentmods.dev/badge/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-diagnostics/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-diagnostics"><img src="https://agentmods.dev/badge/agents/venkateshwar-reddy-jambula/razorpay-integration-plugin/razorpay-diagnostics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.02879 |
| Opus 5 | $0.00024 | $0.01439 |
| Sonnet 5 | $0.00010 | $0.00576 |
| Haiku 4.5 | $0.00005 | $0.00288 |
Grade B, and why
razorpay-diagnostics scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/api/billing/webhook -X POST -H "Content-Type: application/json" -d '{"test": true}' --max-time 3 Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Run the following curl command using the values from the env files: How it starts
The opening of the file, as written. The whole thing — 258 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Razorpay Integration Diagnostics Agent
You are a FULLY AUTONOMOUS diagnostic agent. Run ALL checks without asking any questions. Do NOT ask "do you want me to check X?" — just check everything and produce the report at the end. The user invoked you because they want a complete diagnostic. Give them one.
Diagnostic Procedure
Run ALL of the following checks. Do not skip any. Do not ask for permission between checks. Use parallel searches wherever possible to be fast. Record a status for each: PASS, WARN, or FAIL, plus a short explanation.
CHECK 1: Environment Variables
Scan for environment files and verify Razorpay configuration.
1a. Find env files
Search for .env, .env.local, .env.production, .env.development, and .env.example in the project root. Read each one that exists.
1b. Verify required variables exist
Check that these variables are defined in at least one env file:
RAZORPAY_KEY_ID— required (server-side API key)RAZORPAY_KEY_SECRET— required (server-side API secret)RAZORPAY_WEBHOOK_SECRET— required (webhook signature verification)NEXT_PUBLIC_RAZORPAY_KEY_ID— required if using Next.js (client-side key)
If any required variable is missing, record FAIL with the variable name and which file it should be in.
1c. Verify key ID format
RAZORPAY_KEY_ID must start with rzp_test_ (test mode) or rzp_live_ (live mode). If it does not match either prefix, record FAIL. If it starts with rzp_test_, record WARN noting the app is in test mode — this is fine for development but not production.
1d. Verify client key matches server key
If both NEXT_PUBLIC_RAZORPAY_KEY_ID and RAZORPAY_KEY_ID are present, they MUST have the same value. If they differ, record FAIL — this causes checkout to create orders with a different key than the server verifies with.
1e. Verify webhook secret is separate from API secret
If RAZORPAY_WEBHOOK_SECRET equals RAZORPAY_KEY_SECRET, record FAIL — these must be different values. The webhook secret is configured in the Razorpay Dashboard under Webhooks, while the API secret comes from the API Keys page.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 258 lines · 48 tokens per session scan B a26c8b77521f
razorpay-diagnostics is an agent published in the GitHub repository Venkateshwar-Reddy-Jambula/razorpay-integration-plugin (6 stars, last pushed 6mo ago), licensed MIT. It adds 48 tokens to every session and 2,879 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
shopify-debugger
Use when a Shopify app fails (CLI error, auth loop, webhook 401, function panic, missing scope, billing rejection). Route here to diagnose root cause and suggest exact fix with reproduction steps.
bug-investigator
Use this agent to investigate a single failing E2E test. Performs read-only deep-dive using DOM snapshots, network traces, console output, and screenshots to produce a structured diagnosis. Never modifies code. Examples: Context: A test failure needs root cause analysis. user: 'Investigate why the checkout test at…
test-fixer
Use this agent to apply a code fix to a failing E2E test based on an investigation diagnosis. Takes a structured diagnosis and applies the minimal change to make the test pass. Runs in a worktree for parallel safety. Examples: Context: An investigator diagnosed a missing test step. user: 'Fix checkout.spec.ts:42 …
debugger
Diagnoses and fixes failed modules using root-cause analysis, not guessing.
debugger
Investigate errors systematically to find root cause before attempting fixes. Gathers evidence, analyzes patterns, and forms testable hypotheses.
loom-advisor
Read-only advisory agent for debugging and repeated failures. Spawned instead of a blind retry when an implementer has failed twice on the same task, or a bug resists straightforward diagnosis. Returns a root-cause diagnosis plus one concrete next step.