stripe-integration
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard and secure integration patterns for Stripe payment processing without detected malicious behavior.
- [CREDENTIALS_UNSAFE]: The skill follows security best practices by using placeholders like 'sk_test_...' and 'whsec_...' for sensitive API keys and secrets rather than hardcoding actual credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill correctly implements a secure webhook handler that validates incoming data from external sources. 1. Ingestion points: The skill reads external payload data via the request object in SKILL.md. 2. Boundary markers: The implementation uses Stripe's construct_event method to perform cryptographic signature verification. 3. Capability inventory: The skill utilizes the official Stripe library to perform payment operations and includes placeholders for database updates. 4. Sanitization: Signature verification ensures the integrity and origin of the data before it is processed.
Audit Metadata