wc-stripe-add-payment-method
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Stripe.js library (https://js.stripe.com/dahlia/stripe.js) for payment processing. This is a well-known service and the reference is documented neutrally as a deployment invariant.
- [INDIRECT_PROMPT_INJECTION]: The instructions involve handling untrusted user input from payment forms and REST API endpoints. The skill provides clear security requirements, including mandatory nonce verification, user ownership checks, and server-side validation to ensure safe processing of this data.
- [SAFE]: The skill promotes defensive programming by explicitly warning against raw payment data submission to the WordPress server and directing users to keep the payment details within the Stripe.js boundary.
Audit Metadata