upgrade-stripe
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [External Resource Integration]: The skill references official Stripe domains such as docs.stripe.com and api.stripe.com, and uses official packages like @stripe/stripe-js and the stripe library. These resources are maintained by the vendor and are appropriate for the skill's functionality.
- [External Information Retrieval]: The skill directs the agent to retrieve API version details from official documentation. This establishes an indirect prompt injection surface. Ingestion points: docs.stripe.com (referenced in SKILL.md). Boundary markers: None. Capability inventory: Command execution via Stripe CLI, code modification, and network operations (referenced in SKILL.md). Sanitization: None. The risk is considered low as it targets a trusted vendor source.
- [Credential Placeholders]: Code examples include 'sk_test_xxx', which is a standard placeholder for Stripe test environment keys. This does not constitute an exposure of real credentials.
Audit Metadata