The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation includes standard installation commands for common development tools (npm, pip, Homebrew). These are intended for the developer's local environment during the setup phase of an integration project.
[CREDENTIALS_UNSAFE]: While the skill contains examples of Stripe API key formats (e.g., sk_test_...), these are explicitly marked as placeholders and test keys. The documentation contains strong warnings throughout reference files (e.g., 00-overview.md, 12-security.md) advising against committing real secret keys to source control and recommending the use of environment variables or secret vaults.
[EXTERNAL_DOWNLOADS]: The skill references official Stripe resources including js.stripe.com and the official Stripe GitHub repositories. These are well-known, trusted sources for payment processing infrastructure and do not represent a security risk when used as documented for PCI-compliant integrations.
[DATA_EXFILTRATION]: No data exfiltration patterns were detected. The webhook implementation examples (04-webhooks.md) follow security best practices by requiring signature verification and recommending immediate 200 responses to prevent timing attacks or session blocking.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data primarily through Stripe's hosted UI components (Payment Element, Checkout) which are isolated from the host application's context. The documentation correctly advises on using these components to minimize the attack surface for sensitive data handling.

stripe