stripe-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- Trusted Vendor Resources: The skill exclusively references official Stripe domains and well-known cloud provider security services (such as AWS Secrets Manager and Google Cloud Secret Manager) for secret management.
- Secure Credential Handling: The instructions explicitly warn against hardcoding API keys and recommend using secrets vaults or environment variables for sensitive data. It promotes the use of Restricted API Keys (RAKs) following the principle of least privilege.
- Standard Tooling: The inclusion of references to the Stripe CLI and official SDKs is appropriate for the skill's purpose as a developer guide for the Stripe platform.
- Security Best Practices: The documentation provides sound advice on webhook signature verification, Content Security Policy (CSP) implementation, and avoiding the exposure of secret keys in client-side code.
Audit Metadata