stripe-patterns
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and code templates for Stripe integrations focusing on security and consistency.
- [EXTERNAL_DOWNLOADS]: The skill references the
stripeCLI tool for local testing and webhook forwarding. Stripe is a well-known service, and the use of its official CLI is standard practice for payment development workflows. - [CREDENTIALS_UNSAFE]: The instructions explicitly forbid hardcoding API keys and include a checklist to verify that only test-mode keys (e.g.,
sk_test_) are used in development environments. It correctly recommends using environment variables for secret management. - [COMMAND_EXECUTION]: Provides standard CLI commands for testing payment flows locally using the Stripe CLI (
stripe listen,stripe trigger). These are benign developer tools. - [DATA_EXFILTRATION]: No patterns of unauthorized data access or exfiltration were found. The skill specifically mandates webhook signature verification to ensure data integrity from the payment provider.
Audit Metadata