payment-security-clerk-billing-stripe
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill uses appropriate placeholders for sensitive keys (e.g.,
pk_test_...,sk_test_...,whsec_...) within documentation sections, following secure documentation practices. - [REMOTE_CODE_EXECUTION]: No remote code execution patterns were detected. References to the Stripe CLI for local testing are standard developer workflows.
- [INDIRECT_PROMPT_INJECTION]: While the skill describes endpoints that ingest external data (webhooks), it provides explicit instructions and code for mandatory signature verification using the
svixlibrary to prevent data tampering. - [SAFE]: The skill promotes several critical security best practices, including server-side authorization checks, avoiding local storage of credit card data, and implementing idempotency for webhook processing.
Audit Metadata