stripe
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the official
stripeSDK and a utility packagestripe-replit-syncfrom the npm registry to handle database synchronization. - [COMMAND_EXECUTION]: The skill provides instructions for standard development operations, including package installation using
pnpmand execution of product seeding scripts viatsxornode. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources including the Stripe API and webhook payloads.
- Ingestion points: Data enters the system through the
syncBackfill()function (Stripe API) and the/api/stripe/webhookendpoint (SKILL.md, references/code-templates.md). - Boundary markers: The webhook handler implementation includes logic to verify the
stripe-signatureheader before processing payloads (references/code-templates.md). - Capability inventory: The skill is capable of writing configuration files, executing database migrations, and performing Stripe API operations.
- Sanitization: The provided database interaction templates utilize SQL parameterization (e.g.,
sqltags with Drizzle ORM) to prevent injection when querying the synced Stripe schema.
Audit Metadata