stripe-apps
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFE
Full Analysis
- Official CLI and Tooling: The skill directs the agent to use official Stripe CLI commands (
stripe generate app,stripe apps upload) and standard Node.js package managers. These tools are the recognized method for managing Stripe App projects. - Verified Documentation Access: The instructions mandate that the agent use
WebFetchto consult canonical documentation from official Stripe domains (docs.stripe.com) before generating any code. This practice ensures that the resulting application code follows current security and API standards. - Secure Secret Handling: The skill emphasizes the use of the Stripe Secret Store API for managing sensitive tokens and encourages the use of environment variables for local development, aligning with industry best practices for credential management.
- Sandboxed UI Extension Implementation: The instructions correctly enforce the constraints of the Stripe Apps sandboxed environment, such as the prohibition of raw HTML and external script execution within UI extensions, which mitigates cross-site scripting risks.
- Workflow Integrity: The development workflow includes explicit steps for building, testing, and sandboxed validation, ensuring that the resulting app is verified in a safe environment before production use.
Audit Metadata