The Agent Skills Directory

[SAFE]: Secure Webhook Implementation. The ConnectWebhookController template correctly utilizes Stripe\Webhook::constructEvent to verify the Stripe-Signature header against a configured secret. This ensures that only authentic events from Stripe can trigger sensitive internal logic like seller status updates or payment completion events.
[SAFE]: CSRF Protection Best Practices. The skill correctly identifies the need to exclude webhook endpoints from CSRF verification using withoutMiddleware, which is standard and necessary for third-party service callbacks, while maintaining protection for other application routes.
[SAFE]: Secret Management. The templates consistently retrieve Stripe API keys and secrets via Laravel's config() system and environment variables (STRIPE_SECRET, STRIPE_WEBHOOK_SECRET), avoiding the risk of hardcoded credentials.
[SAFE]: Payment Integrity. The MarketplacePaymentController implements idempotency keys for payment creation, which prevents duplicate charges in the event of network retries or agent errors.
[SAFE]: Data Validation and Casting. The provided Eloquent models (Seller, Transaction) use appropriate attribute casting (e.g., boolean, integer, datetime) and mass-assignment protection ($fillable), ensuring that data retrieved from external APIs is correctly typed and stored securely.

laravel-stripe-connect