stripe
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external data from Stripe (invoices, customers, payments, etc.) into the agent's context, creating a potential surface for indirect prompt injection.
- Ingestion points: The skill documentation describes methods to fetch data from Stripe entities like Invoices, Customers, and Payments.
- Boundary markers: None explicitly defined in the skill instructions; it relies on the underlying agent platform's default handling of tool outputs.
- Capability inventory: The skill utilizes the
@apideck/unifySDK to perform network requests to Apideck's API and includes a Proxy API capability for direct Stripe endpoint calls. - Sanitization: Not explicitly present in the skill; it assumes the consumer/SDK handles data parsing.
- [EXTERNAL_DOWNLOADS]: The skill references external resources and documentation from well-known and trusted sources.
- Evidence: Mentions and links to OpenAPI specifications on
specs.apideck.comand documentation onstripe.com. - Note: These references are to the official resources of the service provider and the connector platform, representing standard integration practices.
Audit Metadata