The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external Stripe webhooks, which constitutes an ingestion point for untrusted data.
Ingestion points: The webhook handler in app/api/webhooks/stripe/route.ts reads the request body for processing Stripe events.
Boundary markers: The implementation correctly uses stripe.webhooks.constructEvent with a signature secret to verify payload authenticity before processing.
Capability inventory: The skill performs database updates (db.user.update) and initiates network operations (sending emails via sendDunningEmail).
Sanitization: The skill uses structured JSON parsing via the official Stripe SDK, though it extracts userId from metadata for database queries.
[SAFE]: The skill adheres to security best practices by recommending environment variables for sensitive API keys and secrets rather than hardcoding them.
[SAFE]: The code patterns specifically address avoiding the handling of raw card data to maintain the lowest level of PCI compliance (SAQ-A).

payment-integration