stripe-generated-app-scaffold
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill references sensitive environment variables including
STRIPE_SECRET_KEYandSTRIPE_WEBHOOK_SECRET. It explicitly mandates that the agent must keep these secrets out of source code, using placeholders and secure environment variable management instead. This demonstrates a proactive security posture regarding credential handling. - [COMMAND_EXECUTION]: The instructions involve the use of platform-specific internal tools via the
cofounder runcommand. These are scoped tool calls used to interact with Stripe infrastructure through the platform's CLI and do not represent arbitrary or dangerous shell command execution. - [SAFE]: The skill promotes several security best practices for the generated code, such as verifying checkout success on the server-side, making webhook handlers idempotent, and gating features based on local entitlement state rather than client-side params.
Audit Metadata