The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill actively promotes secure secret management. It explicitly warns against hardcoding API keys in source code and recommends using restricted API keys (rk_*) and platform-specific secret stores. It also suggests pre-commit scanning to detect accidentally committed keys.
[UNVERIFIABLE_DEPENDENCIES]: The skill references external tools and skills from Stripe's official documentation domain. Following the trusted source rule, downloads from well-known services like Stripe are considered safe and are documented here as legitimate developer resources.
[INDIRECT_PROMPT_INJECTION]: While the skill handles external data (webhook payloads), it mandates strict signature verification using stripe.webhooks.constructEvent. This provides robust protection against processing unauthorized or malicious data from external sources.
[COMMAND_EXECUTION]: The skill provides example code for standard backend operations. It correctly implements secure practices such as using raw request bodies for signature verification instead of pre-parsed JSON, which prevents signature bypass.

stripe-integration