stripe-payments
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard documentation and code snippets for Stripe integration, consistent with its stated purpose.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets were found. The instructions correctly advise using placeholders for local development and secrets management tools (e.g.,
npx wrangler secret put) for production environments. - [EXTERNAL_DOWNLOADS]: The skill references official Stripe packages (
stripe,@stripe/stripe-js) and the official Stripe CLI, which are legitimate resources from a well-known service provider. - [INDIRECT_PROMPT_INJECTION]: The skill manages potential injection surfaces in webhook handling by requiring and demonstrating signature verification using the
stripe.webhooks.constructEventAsyncmethod, ensuring that only authentic data from Stripe is processed.
Audit Metadata