A Paymob callback that is accepted without checking its HMAC lets anyone mark an order as paid. A secret key in a NEXT_PUBLIC_ variable ends up in every visitor's browser. This skill finds those mistakes in your code and tells you how to fix each one.

It scans JavaScript, TypeScript, Python, PHP, and Dart files, plus .env files, and returns BLOCK, REVIEW, or NOT FLAGGED with the file, line, reason, and a safer approach. It checks 10 rules: live and test secret keys in code, secrets in public env variables or client code, callbacks without an HMAC check, the wrong HMAC algorithm or fields, Paymob's error_occured spelling, non-constant-time compares, and amounts that are not whole cents.

It also includes a helper that recomputes Paymob's HMAC-SHA512 from a callback you received and tells you whether it matches, plus a guide with tested Node and Python HMAC code.

It is a static check of source text: NOT FLAGGED is not a guarantee.

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your code. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.