integrating-stripe-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical guide for developers integrating Stripe webhooks, focusing on common implementation pitfalls.
- [SAFE]: The code snippets provided for capturing raw request bodies are standard implementations required for secure signature verification as per official Stripe documentation.
- [SAFE]: No hardcoded credentials or malicious exfiltration patterns were identified. The implementation checklist promotes the use of environment variables for secrets.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from Stripe webhook payloads.
- Ingestion points: Request bodies processed in Fastify, Express, and FastAPI handlers in
SKILL.md. - Boundary markers: Explicitly uses
stripe.webhooks.constructEventto verify signatures, ensuring the request originated from Stripe and has not been tampered with. - Capability inventory: Processes webhook data to update organization records via
updateOrgfunctions. - Sanitization: Recommends using
encodeURIComponentfor dynamic URL parameters to prevent malformed URI errors and injection.
Audit Metadata