stripe
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by providing clear instructions on the safe handling of Stripe API keys and the importance of using environment variables. It explicitly warns against common pitfalls like exposing secret keys in client-side code.- [EXTERNAL_DOWNLOADS]: The skill references official Stripe and Supabase resources, such as SDKs and CLI tools. These originate from trusted organizations and are documented neutrally as standard integration steps.- [INDIRECT_PROMPT_INJECTION]: The skill addresses the processing of external webhook data by mandating signature verification. The analysis of this surface is as follows:
- Ingestion points: Webhook API routes defined in SKILL.md and references/webhooks.md.
- Boundary markers: The skill strongly enforces the use of stripe.webhooks.constructEvent to verify data authenticity.
- Capability inventory: The skill facilitates updating local database records in Supabase and managing Stripe checkout sessions.
- Sanitization: Uses official cryptographic signature verification to ensure data integrity.
Audit Metadata