integrate-stripe
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data from Stripe webhooks and API responses. It addresses this attack surface by mandating specific security controls.\n
- Ingestion points: Stripe webhook payloads and API response bodies are consumed to drive application logic (e.g., fulfillment).\n
- Boundary markers: The skill requires signature verification using
stripe.verify_webhookand official SDKs before processing any external data.\n - Capability inventory: The skill includes code patterns for performing network operations via the Stripe API.\n
- Sanitization: Instructions emphasize server-side validation of all payment parameters and the use of verified webhooks as the source of truth.\n- [EXTERNAL_DOWNLOADS]: The skill contains a reference to a GitHub repository (
github.com/wshobson/agents) inreferences/source.mdfor documentation attribution. This is a static URL reference and does not trigger automated downloads or code execution.\n- [SAFE]: The skill demonstrates safe coding practices by providing placeholders for sensitive identifiers and explicitly warning against hardcoding API keys or exposing raw card data.
Audit Metadata