stripe-projects
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [Installation via Remote Script]: The skill includes instructions to download and execute an installation script from
https://cli.stripe.com/install.sh. This is a common pattern for CLI tools and, as it originates from the vendor's official domain, it is considered a standard setup procedure. - [CLI Tooling Integration]: The skill relies on the
stripeCLI and itsprojectsplugin to perform infrastructure operations. This ensures that sensitive operations like provisioning and environment variable management are handled by the vendor's authoritative tools. - [Credential Management Best Practices]: The skill explicitly instructs the agent to never print secret values in responses and to handle environment variables through CLI commands rather than manual file manipulation, which reduces the risk of accidental exposure.
- [Dynamic Tool Execution]: The skill uses the
!syntax (specifically referenced inallowed-tools) to perform checks likewhich stripeand execute the installer. These are scoped to the project's setup and use official vendor sources.
Audit Metadata