stripe-integration-expert
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by using environment variables (e.g.,
STRIPE_SECRET_KEY) to manage secrets, preventing the exposure of hardcoded credentials. - [SAFE]: The webhook handler implementation includes mandatory signature verification using the official Stripe SDK, ensuring that only authentic events from Stripe are processed.
- [SAFE]: The code includes an idempotency layer to track processed event IDs in a database, which prevents replay attacks and duplicate processing of billing transactions.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data from Stripe webhooks.
- Ingestion points: Webhook endpoint at
POST /api/webhooks/stripe(SKILL.md). - Boundary markers: Cryptographic signature verification is performed using
stripe.webhooks.constructEventbefore any data is used. - Capability inventory: The skill updates user subscription statuses in the database and triggers email notifications.
- Sanitization: Data is parsed and validated through the official Stripe library after verification.
Audit Metadata