stripe-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs and references official Stripe libraries, including stripe, @stripe/stripe-js, and @stripe/react-stripe-js, and loads the Stripe.js script from its official CDN (https://js.stripe.com/v3/). These are established and trusted resources for e-commerce payment processing.
- [INDIRECT_PROMPT_INJECTION]: The skill includes code templates for a webhook handler (handleStripeWebhook) that processes external data payloads from Stripe. While this creates an entry point for external data, the implementation provides critical security controls, including automated signature verification using stripe.webhooks.constructEvent and logic to ensure fulfillment operations are idempotent.
- [SAFE]: The integration guidelines emphasize industry security standards, such as using the Stripe Payment Intents API to handle Strong Customer Authentication (SCA), utilizing Stripe Elements to avoid the handling of sensitive card data (reducing PCI DSS scope), and managing secrets through environment variables rather than hardcoded strings.
Audit Metadata