stripe-integration
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill contains standard implementation examples for a well-known payment service. It uses appropriate placeholders for secrets (e.g.,
sk_test_...) and follows best practices for PCI compliance and error handling.\n- [INDIRECT_PROMPT_INJECTION]: The skill includes code for processing external webhook notifications, which is a data ingestion surface. The implementation correctly includes security controls to mitigate risks.\n - Ingestion points: The
/webhookroute inSKILL.mdreceives external data payloads.\n - Boundary markers: Uses
stripe.Webhook.construct_eventto validate the authenticity of the incoming data.\n - Capability inventory: The skill demonstrates common payment fulfillment tasks, such as updating databases and sending emails.\n
- Sanitization: Employs signature verification to ensure the data source is legitimate and untampered.
Audit Metadata