processing-stripe-payments
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates secure coding practices for handling financial transactions, including server-side validation and secure redirection flows.
- [EXTERNAL_DOWNLOADS]: The skill references standard, well-known dependencies including the official Stripe SDK and Clerk for authentication. These are industry-standard tools for the described functionality.
- [COMMAND_EXECUTION]: The provided test script (
scripts/test-webhook.sh) uses the official Stripe CLI to facilitate local development. This is a routine and safe development workflow. - [INDIRECT_PROMPT_INJECTION]: The skill defines logic to process external data received via Stripe webhooks.
- Ingestion points: Webhook request body, signature headers, and metadata fields in
app/api/webhooks/stripe/route.ts. - Boundary markers: None explicitly defined for metadata, but the payload is bounded by standard JSON parsing.
- Capability inventory: Performs database updates (user and subscription records) and triggers email notifications based on webhook events.
- Sanitization: Implements
stripe.webhooks.constructEventto verify the cryptographic signature of the webhook, ensuring the data originates from a trusted source (Stripe) and has not been tampered with.
Audit Metadata