stripe-test-cards-and-webhooks
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides guidance on using Stripe's official test-mode API and canonical test card numbers, which are intended for safe development and testing environments.
- [SAFE]: External dependencies, including the 'stripe' package (NPM/PyPI) and the Stripe CLI downloaded from GitHub, are sourced from a well-known and trusted service provider (Stripe).
- [SAFE]: Evaluation tasks included in the skill (under evals/) are designed to verify the correct implementation of security-critical features. For example, they test for proper webhook signature verification, prevention of duplicate charges via idempotency keys, and appropriate handling of sensitive decline codes.
- [SAFE]: The instructions explicitly discourage security anti-patterns, such as skipping signature verification or mixing production and test keys, and promote the use of environment variables and secrets for credential management.
Audit Metadata