stripe
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides boilerplate code for Stripe integration. No malicious patterns or insecure practices were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill contains a webhook endpoint that ingests external data.
- Ingestion points:
src/app/api/webhooks/stripe/route.tsreads the raw request body. - Boundary markers: The skill implements signature verification using
stripe.webhooks.constructEventwithprocess.env.STRIPE_WEBHOOK_SECRET. - Capability inventory: The logic handles database updates to the
subscriptionstable and retrieves/updates user profiles. - Sanitization: The implementation uses the official Stripe library to validate payloads before processing, effectively mitigating potential injection from the webhook source.
Audit Metadata