stripe-cli
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The install.sh script installs the stripe-cli tool using the Homebrew package manager. This is a standard installation method for the official Stripe command-line tool.
- [COMMAND_EXECUTION]: The skill defines various CLI commands for managing customers, payments, and subscriptions. These operations are performed through the official Stripe CLI and are consistent with the skill's stated purpose.
- [PROMPT_INJECTION]: The skill processes untrusted external data which creates a surface for indirect prompt injection.
- Ingestion points: External data received via 'stripe listen' (webhooks) and 'stripe logs tail' (API logs).
- Boundary markers: None explicitly defined to separate external data from agent instructions.
- Capability inventory: The agent can execute CLI commands, create resources, and modify account state via 'stripe' commands.
- Sanitization: No explicit validation or sanitization of incoming webhook payloads or log entries is documented.
Audit Metadata