stripe

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external data from Stripe (invoices, customers, payments, etc.) into the agent's context, creating a potential surface for indirect prompt injection.
  • Ingestion points: The skill documentation describes methods to fetch data from Stripe entities like Invoices, Customers, and Payments.
  • Boundary markers: None explicitly defined in the skill instructions; it relies on the underlying agent platform's default handling of tool outputs.
  • Capability inventory: The skill utilizes the @apideck/unify SDK to perform network requests to Apideck's API and includes a Proxy API capability for direct Stripe endpoint calls.
  • Sanitization: Not explicitly present in the skill; it assumes the consumer/SDK handles data parsing.
  • [EXTERNAL_DOWNLOADS]: The skill references external resources and documentation from well-known and trusted sources.
  • Evidence: Mentions and links to OpenAPI specifications on specs.apideck.com and documentation on stripe.com.
  • Note: These references are to the official resources of the service provider and the connector platform, representing standard integration practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 06:32 PM