The Agent Skills Directory

[SAFE]: The skill provides comprehensive and secure instructions for Stripe integrations. It includes specific warnings for the agent to never accept or store real payment credentials and to only work in test or sandbox environments.
[INDIRECT_PROMPT_INJECTION]: The skill describes an integration that ingests data from external Stripe webhooks, representing a potential indirect injection surface. However, it implements strong mitigations.
Ingestion points: Webhook route handlers documented in references/webhooks-events.md.
Boundary markers: The skill mandates the use of stripe.webhooks.constructEventAsync to verify webhook signatures before processing.
Capability inventory: The integration involves updating a database projection and making API calls to the Stripe service.
Sanitization: The instructions explicitly require re-fetching the current state of objects directly from the Stripe API rather than trusting the contents of the webhook payload, effectively neutralizing potential payload tampering.
[EXTERNAL_DOWNLOADS]: The skill references official Stripe SDKs and the Better Auth plugin. All referenced packages are from well-known registries and trusted organizations.
[CREDENTIALS_SAFE]: The skill specifically instructs the agent and user to manage secrets using environment variables and secret stores, emphasizing that live keys or webhook secrets should never be logged, printed, or committed to source control.

stripe