stripe-integration
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides technical documentation and code for Stripe integration. All API interactions are conducted through the official stripe library.
- [CREDENTIALS_UNSAFE]: The code snippets include sk_test_..., which is a recognized placeholder for Stripe test keys in technical documentation and does not constitute a leak of live credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data via a webhook endpoint.
- Ingestion points: External HTTP POST requests to the
/webhookendpoint (SKILL.md). - Boundary markers: The implementation relies on Stripe's cryptographic signature for message boundaries and authenticity.
- Capability inventory: The skill performs API calls to Stripe and logs event details; no file system or shell execution capabilities are present.
- Sanitization: Employs stripe.Webhook.construct_event to verify the payload signature, ensuring only authentic data from Stripe is processed.
Audit Metadata