stripe-setup
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly implements Stripe webhook handling by verifying signatures using the
stripe.webhooks.constructEventmethod and theSTRIPE_WEBHOOK_SECRETenvironment variable. - [SAFE]: Secret management follows best practices by using environment variables (
.env) for API keys and webhook secrets instead of hardcoding production credentials. - [SAFE]: The code uses structured data validation (via
zod) for API routes and correctly distinguishes between SDK usage for programmatic operations and MCP tools for read-only lookups. - [SAFE]: Dependencies are restricted to official, well-known packages (
stripeand@stripe/stripe-js) from the official Stripe organization.
Audit Metadata