CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

stripe-best-practices

Guides Stripe integration decisions across development and test environment planning (separate sandboxes vs the shared test mode sandbox), API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, tax and registrations (Stripe Tax, automatic_tax, product tax codes), Treasury financial accounts, integration options (Checkout, Payment Element), migrating from deprecated Stripe APIs, and security best practices (API key management, API key permissions, webhooks, OAuth). Use when planning, building, modifying, testing, or reviewing any Stripe integration, including choosing a development environment, accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, collecting sales tax, VAT, or GST, creating connected accounts, or implementing secure key handling.

90

1.22x
Quality

88%

Does it follow best practices?

Impact

98%

1.22x

Average score across 3 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

The canonical home for this skill is stripe-best-practices in stripe/ai

SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, well-structured router with concrete commands, parameter-level critical rules, and real guardrail checkpoints. Weaknesses concentrate in scattered time-sensitive version data, one over-long rationale clause, and confusing MCP/sandbox conditional lines.

Suggestions

Consolidate the time-sensitive version data (the SDK version table, 'Latest Stripe API version: 2026-09-30.endive', and the '2026-03-25.dahlia' conditional) into a single clearly marked section or reference file so staleness is localized and the body stays tight.

Rewrite the three fragmented MCP/sandbox lines ('If stripe sandbox create is used, don't use MCP' / 'stripe sandbox claim' / 'stripe whoami') into one coherent rule stating exactly when to use MCP and what to run first.

Trim the rationale in the payment_method_types rule to its essential reason (dynamic payment methods, Dashboard-configurable) to reclaim roughly 20 tokens.

DimensionReasoningScore

Conciseness

The body is dense and instruction-like (routing table, critical rules), but the time-sensitive items — 'Latest Stripe API version: 2026-09-30.endive', the 7-row SDK version table, and 'On API version 2026-03-25.dahlia or later' — sit outside any old-patterns/deprecated section, and the payment_method_types rule carries a padded rationale ('which enables you to configure payment method settings from the Dashboard and dynamically display the most relevant eligible payment methods to each customer to maximize conversion'). Anchor 3 ('mostly efficient but includes some unnecessary explanation or could be tightened') fits better than 4 because these instances recur.

3 / 5

Actionability

Largely executable guidance: 'Install the Stripe CLI (`npm i -g @stripe/cli`) and run the command `stripe sandbox create`', 'Use `stripe whoami --format json` for CLI auth checks', 'pass the parameter `integration_identifier` to `checkout.sessions.create`', and exact key prefixes ('rk_' over 'sk_'). It falls short of 5 because the MCP/sandbox lines ('If `stripe sandbox create` is used, don't use MCP.' / 'first make sure `stripe sandbox claim` is run') are fragmented and leave Claude without a clear action.

4 / 5

Workflow Clarity

A clear routing workflow exists — integration routing table, then 'Read the relevant reference file before answering any integration question or writing code', then critical rules — with a genuine validation checkpoint ('read the tax reference and confirm the user has an active registration' before enabling `automatic_tax`). Not 5 because there is no explicit ordering when multiple domains apply and the webhook rule defers its checkpoint to the reference.

4 / 5

Progressive Disclosure

The ~60-line body is a true overview: a routing table pointing to all six real reference files (payments, connect, billing, tax, treasury, security — verified present and one level deep with no nested references), plus clearly signaled links like 'See security reference' and '[tax reference](references/tax.md)'. Content is appropriately split and navigation is task-indexed, matching the anchor-5 example.

5 / 5

Total

16

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a model example: third-person voice, an explicit what plus an explicit 'Use when...' clause with concrete triggers, comprehensive natural keywords with synonyms, and unambiguous Stripe-specific scope. No material weaknesses found.

DimensionReasoningScore

Specificity

'API selection (Checkout Sessions vs PaymentIntents)', 'Connect platform setup (Accounts v2, controller properties)', 'migrating from deprecated Stripe APIs', and 'security best practices (API key management, API key permissions, webhooks, OAuth)' enumerate many concrete capabilities with named APIs and parameters, comprehensively covering the skill's scope — matching the anchor-5 example's breadth rather than the 'minor gaps' of anchor 4.

5 / 5

Completeness

Both parts are explicit: the what ('Guides Stripe integration decisions across development and test environment planning... security best practices (API key management...)') and the when ('Use when planning, building, modifying, testing, or reviewing any Stripe integration, including...'), with concrete trigger phrases — exactly the anchor-5 pattern.

5 / 5

Trigger Term Quality

'Use when planning, building, modifying, testing, or reviewing any Stripe integration, including... accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, collecting sales tax, VAT, or GST, creating connected accounts' covers the natural phrases users say, including synonyms (accepting/processing payments; sales tax/VAT/GST). Comprehensive coverage per the anchor-5 definition, so not 4.

5 / 5

Distinctiveness Conflict Risk

'Stripe integration', 'Checkout Sessions', 'PaymentIntents', 'Stripe Tax', and 'connected accounts' pin the description to a single clear niche with distinct triggers; virtually no other skill would fire on these terms, matching anchor 5.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

stripe/ai

Path

providers/codex/plugin/skills/stripe-best-practices/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.