The Agent Skills Directory

[SAFE]: The skill demonstrates robust security engineering for payment integrations. All primary workflows, including Checkout Sessions and Payment Intents, are designed to prevent common vulnerabilities like client-side price manipulation. For indirect prompt injection analysis: 1) Ingestion point: app/api/webhooks/stripe/route.ts; 2) Boundary markers: Mandatory cryptographic signature verification via stripe.webhooks.constructEvent; 3) Capability inventory: Database updates and order fulfillment logic; 4) Sanitization: Signature verification ensures the data origin and integrity before processing.\n- [CREDENTIALS_UNSAFE]: Environment variable handling follows best practices. The skill includes clear warnings against the exposure of secret keys (STRIPE_SECRET_KEY) and uses proper segregation from client-exposed variables (NEXT_PUBLIC_ prefix).\n- [EXTERNAL_DOWNLOADS]: All external dependencies are restricted to official Stripe libraries (@stripe/stripe-js, stripe) and standard utility packages (uuid) sourced from the official NPM registry.\n- [REMOTE_CODE_EXECUTION]: No remote code execution, dynamic script evaluation, or unsafe deserialization patterns were detected across the code templates.\n- [PROMPT_INJECTION]: The 33 files were scanned for instructions aimed at overriding agent behavior or bypassing safety guardrails; no such malicious patterns were found.\n- [COMMAND_EXECUTION]: Development instructions include standard, safe usage of the official Stripe CLI for local testing and webhook forwarding, which do not pose a risk to the end-user environment.

stripe