stripe-webhooks
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements industry-standard security practices for webhook handling by demonstrating and enforcing cryptographic signature verification using official Stripe SDKs.
- [CREDENTIALS_UNSAFE]: No active credentials or secrets were detected. Environment variable files (.env.example) and test suites use clearly identified placeholders such as 'sk_test_your_api_key_here' and 'whsec_test_secret'.
- [EXTERNAL_DOWNLOADS]: The documentation references official tools including the Stripe CLI and the author's own Hookdeck CLI for local development purposes. These are standard developer tools from well-known or verified sources.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes external data via webhooks, it provides explicit instructions and code to verify the authenticity of the data source before processing, effectively mitigating unauthorized input injection.
- [COMMAND_EXECUTION]: All shell commands provided in the documentation are for local development setup, such as installing dependencies via npm or pip, and do not involve execution of untrusted remote scripts.
Audit Metadata