stripe-projects-auth0
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates legitimate developer workflows by orchestrating the
stripeCLI and Auth0 resources. It includes safety-oriented instructions such as using the local SDK documentation as a source of truth rather than potentially outdated training data. - [DATA_EXPOSURE]: The skill uses the command
stripe projects env --pull, which downloads environment variables to the local machine. While these variables typically contain sensitive secrets like API keys or client secrets, this is the intended and standard behavior for the Stripe Projects environment synchronization process. - [EXTERNAL_DOWNLOADS]: The skill references the official Auth0 Management API OpenAPI specification (
auth0.com/docs/api/management/openapi.json). This is a reference to a trusted, well-known service domain relevant to the skill's primary purpose. - [COMMAND_EXECUTION]: The skill executes local shell commands through the
stripeCLI to manage project state, catalog resources, and environment configuration. These operations are consistent with the skill's stated objective of automating Auth0 provisioning within Stripe Projects. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources, including JSON output from the
stripeCLI (catalog auth0 --json) and the contents of locally installed SDK README files. While these are potential injection surfaces, the skill uses the information to inform configuration parameters rather than for direct execution of instructions found within that data.
Audit Metadata