ZainCash sends the payment result as a signed token. Code that reads that token without checking its signature lets anyone forge a "SUCCESS" and get an order marked as paid. This skill finds that mistake and eleven others in your ZainCash Payment Gateway v2 integration, and tells you how to fix each one.

It scans JavaScript, TypeScript, Python, PHP, and Dart files, plus .env files, and returns BLOCK, REVIEW, or NOT FLAGGED with the file, line, reason, and a safer approach. It checks secrets in code, in public env variables, and in Flutter or browser code; tokens read without a signature check; a currency other than IQD; jwt.verify without an algorithms option; fixed externalReferenceId values; refunds whose FAILED status is never checked; decimal dinar amounts; payment URLs built by hand; webhooks that ignore eventId; and the test environment URL left in code.

It also includes a helper that verifies a ZainCash redirect or webhook token with your API key (HS256) and shows the status, order, transaction, and amount inside it.

It is a static check of source text: NOT FLAGGED is not a guarantee. Java and C# files are not scanned.

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your code. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.