stripe
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard integration patterns for Stripe, a well-known and trusted payment processor. All external links point to official Stripe documentation and developer resources.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing official SDKs (
stripe,@stripe/stripe-js) from standard package registries (NPM and PyPI). These are well-known packages from a trusted service provider. - [CREDENTIALS_UNSAFE]: The skill uses safe practices for secret management. It correctly advises against exposing secret keys to the client side and provides placeholder values (
sk_test_xxx,whsec_xxx) rather than hardcoded credentials. It explicitly recommends using environment variables via.envfiles. - [DATA_EXFILTRATION]: The skill demonstrates server-side communication with Stripe's official API. No unauthorized data exfiltration or access to sensitive local files was detected.
- [PROMPT_INJECTION]: No prompt injection attempts or instructions to bypass safety guidelines were found. The instructional content is focused on technical implementation.
- [COMMAND_EXECUTION]: The skill includes instructions for using the official Stripe CLI for testing webhooks locally. These are standard development workflows and do not pose a security risk in this context.
Audit Metadata