stigg-sp
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: A heuristic detection for instruction concealment was evaluated as a false positive. The instruction to "provision programmatically" rather than directing the user to a manual signup form is a functional requirement for the Stigg/Stripe Projects integration workflow and does not attempt to hide malicious activity or override agent safety protocols.
- [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by explicitly instructing the agent to keep server-side API keys secret and providing guidance on using framework-specific public variables for client-side keys to prevent accidental exposure of privileged secrets.
- [EXTERNAL_DOWNLOADS]: All external references, including NPM packages (@stigg/node-server-sdk, @stigg/react-sdk) and service endpoints (mcp.stigg.io, docs.stigg.io), are owned by the authoring vendor and are used appropriately for integration and documentation purposes.
Audit Metadata