api-commerce-stripe
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily instructional and provides high-quality security guidance for payment processing, including the mandatory use of environment variables for secrets, signature verification for webhooks, and idempotency for mutations.
- [CREDENTIALS_UNSAFE]: The file
examples/core.mdincludes an illustrative 'Bad Example' containing a placeholder secret key (sk_live_abc123...) specifically to warn developers against hardcoding credentials in source control. This is a defensive teaching pattern rather than an exposure of real credentials. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data from Stripe webhooks. It explicitly mitigates this risk by requiring the use of
stripe.webhooks.constructEvent()with the raw request body to verify the authenticity and integrity of incoming event data before processing it in the application logic. - [EXTERNAL_DOWNLOADS]: The skill utilizes the standard
stripeNode.js package to communicate with official Stripe API endpoints. These operations target a well-known service and are considered safe within the context of a commerce-focused skill.
Audit Metadata