stripe-webhook-integration
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements logic to ingest and process external webhook payloads from Stripe. While it includes mandatory signature verification using
Stripe::Webhook.construct_eventto authenticate the sender, processing untrusted data from an external API creates an attack surface for indirect prompt injection if the payload data is later utilized in LLM prompts. - [EXTERNAL_DOWNLOADS]: The skill references the official
stripe-rubygem and theStripe CLIvia Homebrew. These are well-known, trusted resources from a recognized organization (Stripe) and do not pose a security risk. - [CREDENTIALS_UNSAFE]: The documentation contains placeholders for API keys (e.g.,
whsec_test_XXX,sk_test_YYY). These are clearly identified as examples and the skill correctly advises storing real credentials in encrypted Rails credentials files.
Audit Metadata