The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill uses safe placeholders for sensitive data, such as sk_test_xxx for Stripe API keys and whsec_* for webhook secrets. It correctly instructs the user to store actual secrets using wrangler secret put, which is a standard and secure practice for managing environment variables.
[EXTERNAL_DOWNLOADS]: The skill references the official stripe package from the NPM registry and interacts with Stripe's official API domain (api.stripe.com). These are well-known and trusted services for payment processing.
[PROMPT_INJECTION]: The instructions are strictly technical and instructional. There are no attempts to override agent behavior, bypass safety filters, or use adversarial role-play patterns.
[DATA_EXPOSURE]: The skill includes a specific security implementation for verifying webhook signatures using constructEventAsync and SubtleCryptoProvider. This demonstrates a high level of security awareness by ensuring that incoming data originates from the trusted provider before processing it.
[COMMAND_EXECUTION]: Shell commands provided (curl, npm install, wrangler secret put) are standard development operations required for the stated purpose of the skill. No suspicious or obfuscated commands were detected.

stripe-mor