stripe-cli

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The install.sh script installs the stripe-cli tool using the Homebrew package manager. This is a standard installation method for the official Stripe command-line tool.
  • [COMMAND_EXECUTION]: The skill defines various CLI commands for managing customers, payments, and subscriptions. These operations are performed through the official Stripe CLI and are consistent with the skill's stated purpose.
  • [PROMPT_INJECTION]: The skill processes untrusted external data which creates a surface for indirect prompt injection.
  • Ingestion points: External data received via 'stripe listen' (webhooks) and 'stripe logs tail' (API logs).
  • Boundary markers: None explicitly defined to separate external data from agent instructions.
  • Capability inventory: The agent can execute CLI commands, create resources, and modify account state via 'stripe' commands.
  • Sanitization: No explicit validation or sanitization of incoming webhook payloads or log entries is documented.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 11:16 AM
Security Audit — agent-trust-hub — stripe-cli