CtrlK
BlogDocsLog inGet started
Tessl Logo

stripe-apps

Use when building, modifying, or reviewing a Stripe App — or when the user describes something that implies one (e.g. "add a panel to the customer page", "customize my Stripe Dashboard", "react to Stripe events from my app", "connect my service to Stripe without sharing API keys"). Covers the full app development workflow (scaffold, preview, upload, versioning), UI extension architecture (sandboxed iframe, Stripe UI toolkit, viewports), extension types (UI extensions, backend-only, extension interfaces, embedded apps), authentication (platform keys, OAuth, restricted API keys), stripe-app.yaml manifest setup (permissions, viewports, CSP), webhook configuration for apps, Secret Store API, `fetchStripeSignature` auth, and marketplace publishing, plus submitting one agentic feedback report after a build. Use when the user mentions Stripe Apps, UI extensions, @stripe/ui-extension-sdk, stripe-app.yaml, Dashboard extensions, or customizing the Stripe Dashboard.

75

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable instruction skill with strong workflow sequencing, validation checkpoints, and excellent progressive disclosure via a navigable reference table. The main weaknesses are mild verbosity in the role-framing sections and delegation of implementation code to external references rather than inline copy-paste examples.

Suggestions

Trim the 'Your role' narrative ('PROJECT BUILDER and INSTRUCTOR', 'patient guide') to a single imperative line; the behavioral rules already encode these expectations.

Inline one minimal copy-paste server.js snippet (CORS + fetchStripeSignature verification) and one App.tsx SDK-import snippet so the common full-stack case is executable without first WebFetching the canonical docs.

De-duplicate the discovery/upload guidance: the HARD RULES table, Step 1, and Step 4 each restate the upload-before-signing-secret and ask-questions-first requirements; consolidate to a single source.

DimensionReasoningScore

Conciseness

Mostly efficient with prescriptive tables and numbered steps, but the 'Your role' narrative ('PROJECT BUILDER and INSTRUCTOR', 'patient guide') and repeated re-emphasis of the discovery/upload rules add padding that could be trimmed; not quite the lean anchor-5 example.

4 / 5

Actionability

Concrete commands (stripe generate app, pnpm build/test, stripe apps upload), exact filenames (ui/src/views/App.tsx, server.js), and precise constraints (React 17.0.2, event_read permission, CORS only on UI endpoints) are highly executable, but common-case implementation code is delegated to references/canonical docs rather than shown inline, leaving minor gaps.

4 / 5

Workflow Clarity

Steps 1-5 are explicitly sequenced with validation gates (private-preview confirmation, 'wait for explicit confirmation', Step 5 ls verification), a troubleshooting table as an error-recovery feedback loop, and the HARD RULES/BLOCKED tables as checklists.

5 / 5

Progressive Disclosure

SKILL.md is a clear overview with a 'Reference files' table mapping 11 real one-level-deep files to 'Read when' conditions; all referenced paths exist in references/ and content is appropriately split out.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that explicitly covers both capabilities and trigger conditions with concrete natural-language phrases and technical identifiers. Voice is third person throughout, with second-person phrasing appearing only inside quoted example utterances, so no voice penalty applies.

DimensionReasoningScore

Specificity

Lists many concrete actions — scaffold/preview/upload/versioning, manifest setup, webhook configuration, Secret Store, fetchStripeSignature auth, marketplace publishing, feedback submission — giving comprehensive coverage rather than vague abstractions.

5 / 5

Completeness

Explicitly answers what (full workflow, UI architecture, extension types, auth, manifest, webhooks, Secret Store, publishing, feedback) and when (two 'Use when...' clauses with concrete trigger phrases), matching the anchor for clearly answering both.

5 / 5

Trigger Term Quality

Covers natural user phrases ('add a panel to the customer page', 'customize my Stripe Dashboard', 'react to Stripe events', 'connect my service to Stripe without sharing API keys') plus technical identifiers (@stripe/ui-extension-sdk, stripe-app.yaml, Dashboard extensions).

5 / 5

Distinctiveness Conflict Risk

Occupies a clear Stripe Apps niche with distinct triggers (stripe-app.yaml, @stripe/ui-extension-sdk, Dashboard extensions) and minimal overlap with other skills.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
stripe/ai
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.