stripe-refund-auditor
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runwithin its test suite (tests/integration_test.py) to execute its own Python scripts. This is standard behavior for integration testing and is limited to invoking local skill files. - [CREDENTIALS_SAFE]: The skill correctly handles the
STRIPE_API_KEYby reading it from the environment or a.env.localfile. It includes a safety check in the integration tests to ensure that only Stripe test-mode keys (sk_test_*) are used, preventing accidental execution against production data. - [DATA_EXPOSURE]: Data is stored in temporary local files (
/tmp/refunds.jsonland/tmp/refund-scores.json) for processing. There are no patterns of exfiltrating this data to external, non-Stripe domains. - [EXTERNAL_DOWNLOADS]: The skill declares its dependencies (
stripe,pydantic) via standardruntime-pipconfiguration. The code itself does not perform unverified downloads or remote script execution.
Audit Metadata