api-commerce-stripe
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates excellent security awareness by providing 'Red Flags' and 'Critical Requirements' sections that explicitly forbid dangerous practices such as exposing secret keys in client-side code or using parsed JSON for webhook signature verification.
- [SAFE]: All code examples correctly utilize environment variables (e.g.,
process.env.STRIPE_SECRET_KEY) and emphasize the use of idempotency keys to prevent duplicate transactions, which is a standard safety measure for payment APIs. - [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external data from Stripe (webhook events). While this represents a theoretical ingestion surface for indirect prompt injection (e.g., via malicious customer metadata), the instructions mandate the use of
stripe.webhooks.constructEvent()for signature verification, ensuring the data originates from a trusted source (Stripe) and has not been tampered with. - [EXTERNAL_DOWNLOADS]: The skill references the official
stripenpm package and the Stripe CLI, both of which are well-known and trusted resources for the intended functionality.
Audit Metadata