What is audit-payment-system?

A read-only review of systems that charge customers and record money, including payment providers, webhooks, and accounting ledgers.

Use it to check duplicate-payment protection, payment notifications, receipt handling, reconciliation, double-entry ledgers, and PCI DSS obligations.

It helps prevent double charges, missing money records, untrusted payment confirmations, and payment data that creates compliance risk.

audit-payment-system — Skill for Claude Code and Codex by kensaurus

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add kensaurus/cursor-kenji --skill audit-payment-system

Clone the repo

git clone --depth 1 https://github.com/kensaurus/cursor-kenji

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/audit-payment-system.svg)](https://agentmods.dev/skills/kensaurus/cursor-kenji/audit-payment-system)

Your own site

<a href="https://agentmods.dev/skills/kensaurus/cursor-kenji/audit-payment-system"><img src="https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/audit-payment-system.svg" alt="Measured on agentmods" height="20"></a>

Per session 76 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 5,058 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00076	$0.05058
Opus 5	$0.00038	$0.02529
Sonnet 5	$0.00015	$0.01012
Haiku 4.5	$0.00008	$0.00506

Measured 4d ago against content hash c9ac7df63a99, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

audit-payment-system scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/audit-payment-system/SKILL.md · 268 lines

How it starts

The opening of the file, as written. The whole thing — 268 lines — stays where its author put it; the contents beside it link to each section on GitHub.

audit-payment-system — Money-Movement Correctness & Compliance Audit

Degree of freedom: MIXED — Scope, matrix, and severity [HIGH freedom]; Phase 0 detection searches [LOW freedom — run exactly]. Do not write exploit or payment-fraud PoCs — quote the missing control, never a replay or spoof recipe.

Read-only. Assess and prioritize; do not change code. Payment code is a STOP-and-confirm surface — findings feed a human-reviewed remediation, ideally with a stronger model. Delegations: per-call resilience → audit-resilience; PCI/secrets/authz → audit-security; ledger schema → audit-db-schema; outbox/saga structure → audit-backend-architecture; append-only integrity → plan-data-integrity; Stripe integration → the Stripe plugin skills. This skill owns payment-domain correctness.

Payment failures are silent: a retried charge is a double-charge, a lost ledger write is vanished money, a logged PAN is PCI liability, an unverified webhook is an untrusted "paid". Three pillars: idempotency, a double-entry ledger (when in scope), reconciliation — plus PCI DSS v4.0.1 and webhooks as source of truth (never trust the sync API response alone).

Core principle — earn each control by scope; every gap is money or liability

Not every app needs an in-house double-entry ledger. Stripe Checkout offloads ledger, settlement, and most PCI — flagging "no double-entry ledger" there is noise. Idempotency, webhook verification, state sync, and tokens-only apply to everyone who moves money. Gate depth by scope (Phase 0). Critical = a customer is charged twice, money is lost/unaccounted, or card data is exposed. There is no "low severity" for a double-charge.

How to reason — Observe → Interpret → Classify → Severity

Observe — quote the mutation/webhook/ledger file:line (or "searched, none found")
Interpret — what money or liability path breaks if that control is missing?
Classify — Implemented / Partial / Missing / N/A (tier reason); control id (A1–G4)
Severity — double-charge, lost money, or PAN/CVV exposure = Critical; P2-only rows are N/A on P0

Read the full file on GitHub · 268 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

references/checklist.md 17 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

4d ago First seen · 268 lines · 76 tokens per session scan A c9ac7df63a99

Subscribe to this mod's changes

audit-payment-system is a skill published in the GitHub repository kensaurus/cursor-kenji (9 stars, last pushed 10d ago), licensed MIT. It adds 76 tokens to every session and 5,058 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Finance and fintech Security agent-skills ai-agent claude claude-skills cursor cursor-ai

yc-batch-evaluator

Evaluate YC batch companies for investment — scrapes the YC directory, researches each company and its founders (work history, LinkedIn, website), assesses founder-company fit, and exports to Google Sheets with priority rankings. Use when asked to evaluate YC companies, research a YC batch, screen startups, or do due…

gooseworks-ai/goose-skills · 72 tokens

company-funding-search

Find company funding history, investors, and investment details.

gooseworks-ai/goose-skills · 15 tokens

802-regulations-dora

Use when reviewing, designing, or modifying Java enterprise systems that may support financial entities, critical ICT services, third-party ICT provider integrations, or operational resilience obligations under DORA. This should trigger for requests such as Review a Java platform for DORA ICT risk controls; Design…

jabrena/plinth · 97 tokens

helius-jupiter

Skill "helius-jupiter" from helius-labs/core-ai, covering helius x jupiter — build defi apps on solana, mcp router surface, prerequisites, 1. helius mcp server and 2. jupiter api key.

helius-labs/core-ai · 0 tokens

helius-okx

Skill "helius-okx" from helius-labs/core-ai, covering helius x okx — build trading & intelligence apps on solana, mcp router surface, prerequisites, 1. helius mcp server and 2. okx skill library (required).