stripe-webhook-signature-verification
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides correct and secure implementation guidance for cryptographic signature verification using the Stripe SDK. It follows industry standards by using environment variables for sensitive credentials rather than hardcoding them.
- [INDIRECT_PROMPT_INJECTION]: The skill implements strong boundary validation by requiring a successful HMAC-SHA256 signature check via
stripe.webhooks.constructEventbefore any data from the untrusted webhook request is processed or written to the database. - [COMMAND_EXECUTION]: No dangerous command execution or subprocess invocation patterns were identified. The instructions use standard API calls and parameterized SQL queries.
- [DATA_EXFILTRATION]: No network operations or unauthorized file access patterns were found that could lead to data exfiltration. The skill focuses on verifying incoming data rather than sending local data out.
Audit Metadata