stripe-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill instructions and code snippets demonstrate secure patterns for payment integration. The examples follow best practices for secret management by using environment variables and avoid arbitrary command execution or unauthorized data access.
- [INDIRECT_PROMPT_INJECTION]: The skill addresses a vulnerability surface where the agent processes external data via Stripe webhooks. Ingestion Point: Webhook request body in SKILL.md. Boundary Markers: None (documentation guidance). Capability Inventory: Snippets interact with environment variables and call internal subscription handling logic. Sanitization: The skill specifically requires cryptographic signature verification using the Stripe SDK to ensure the authenticity of data before processing.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and public repositories from official Stripe sources. These are well-known, established services used for integration guidance and do not represent a remote code execution risk.
Audit Metadata