usage-based-billing
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious code, unauthorized access patterns, or exfiltration attempts were detected. The skill defines a read-only audit workflow using official Stripe documentation and tools, which is consistent with its stated purpose.
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests data from external Stripe API calls (such as price objects, meter definitions, and usage records) into the agent's context. This is handled as safe given the skill's purpose and the lack of high-risk capabilities.
- Ingestion points: Stripe MCP tool outputs (e.g., GetPrices) and meter definitions reviewed via the Dashboard.
- Boundary markers: None defined in the output template to separate external data from agent instructions.
- Capability inventory: Interactions are limited to Stripe MCP tools (e.g., CallMcpTool).
- Sanitization: No explicit sanitization or validation of the ingested Stripe data is specified in the audit workflow.
Audit Metadata