stripe
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a standard API integration with Stripe for data retrieval purposes. The architecture follows best practices by using separate server-side libraries and routes to handle authentication and data processing.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets were detected. The skill correctly references a 'STRIPE_SECRET_KEY' to be configured in the application settings, adhering to secure secret management practices.
- [EXTERNAL_DOWNLOADS]: The skill connects to 'api.stripe.com', which is the official domain of a well-known service. No suspicious or unverified third-party downloads were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Stripe API responses (such as invoice notes or customer names). While this presents a potential surface for indirect prompt injection, it is a standard characteristic of data-processing skills and no specific exploitable patterns were found.
- [COMMAND_EXECUTION]: No shell command execution or subprocess spawning was identified within the provided instruction set.
Audit Metadata