payment-integration
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides secure implementation patterns for payment processing.
- Webhook Security: The inclusion of Stripe webhook signature verification (
stripe.webhooks.constructEvent) correctly mitigates potential spoofing attacks and ensures data integrity from the external source. - Secret Management: Guidance explicitly instructs users to store API keys and secrets in environment variables (
STRIPE_SECRET_KEY,STRIPE_WEBHOOK_SECRET) instead of hardcoding them in the source code. - PCI Compliance: The guidance emphasizes using Stripe-hosted checkout surfaces (Stripe Checkout or Elements) to ensure that sensitive card data never touches the application's server, maintaining a low PCI compliance tier (SAQ-A).
- Idempotency: The webhook handler implementation includes an idempotency check by tracking processed event IDs in the database, which prevents double-processing or replay attacks for events delivered more than once.
- Trusted Dependencies: The skill utilizes the official
stripeNode.js library, which is a recognized and trusted service.
Audit Metadata