engineering-stripe-game-payments
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a webhook endpoint to ingest external data from Stripe.
- Ingestion points: The endpoint
/webhooks/stripedefined inboilerplate/webhooks.tsreceives JSON payloads from Stripe's servers. - Boundary markers: The skill correctly implements signature verification using
stripe.webhooks.constructEvent, which acts as a boundary ensuring data only comes from the verified provider. - Capability inventory: The skill uses the official Stripe SDK for payment management and uses in-memory sets for idempotency; it does not execute arbitrary shell commands or perform unsafe file system operations.
- Sanitization: Signature verification using a secret from environment variables validates both the source and the integrity of the data, effectively preventing spoofing.
- [COMMAND_EXECUTION]: The
SKILL.mdfile documents the installation of the official Stripe library usingbun add stripe, which is a benign and necessary step for the skill's functionality.
Audit Metadata