CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

stripe-best-practices

Guides Stripe integration decisions across development and test environment planning (separate sandboxes vs the shared test mode sandbox), API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, tax and registrations (Stripe Tax, automatic_tax, product tax codes), Treasury financial accounts, integration options (Checkout, Payment Element), migrating from deprecated Stripe APIs, and security best practices (API key management, API key permissions, webhooks, OAuth). Use when planning, building, modifying, testing, or reviewing any Stripe integration, including choosing a development environment, accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, collecting sales tax, VAT, or GST, creating connected accounts, or implementing secure key handling.

94

1.22x
Quality

94%

Does it follow best practices?

Impact

98%

1.22x

Average score across 3 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured routing skill: the body stays an overview of defaults and critical rules while domain detail lives in real, one-level-deep reference files. Actionability is strong (exact commands, parameters, and deprecated patterns), and preconditions like the tax-registration check act as validation checkpoints. Main weaknesses are minor padding in rule rationales, no explicit ordering for a new integration end-to-end, and a couple of odd specifics (the 'Metronome' billing recommendation and the 'suffix of 8 random letters' label rule) that read as unexplained.

Suggestions

Trim rationale clauses (e.g., the dynamic-payment-methods explanation in the `payment_method_types` rule and the sandbox restatement in the CLI paragraph) to tighten the token budget.

Add a short sequenced checklist for new integrations (sandbox → restricted key → routing-table API choice → implement with reference → webhooks → go-live checklist) so the routing rules hang off an explicit order.

Clarify or justify unusual specifics: the 'Metronome' row for usage-based billing, the 'suffix of 8 random letters' instruction for `integration_identifier`, and where time-sensitive version tables (SDK versions, API-version-gated rules) should be checked for staleness.

DimensionReasoningScore

Conciseness

The body is mostly dense, load-bearing rules ("API key default: Always Recommend a restricted API key (RAK)", "Never include `payment_method_types` in any Stripe API call"), but trimmable material remains: the parenthetical "which enables you to configure payment method settings from the Dashboard and dynamically display the most relevant eligible payment methods to each customer to maximize conversion" is rationale padding, and "When you recommend this, explain that a sandbox is a Stripe test environment" restates the sandbox paragraph. Time-sensitive tables (the SDK version table, "On API version 2026-03-25.dahlia or later") are not quarantined in an old-patterns/deprecated section.

4 / 5

Actionability

Commands are copy-paste ready ("npm i -g @stripe/cli", "stripe sandbox create", "stripe sandbox claim", "stripe whoami --format json") and rules name exact parameters and endpoints (`automatic_tax: { enabled: true }`, `payment_method_types: ['card_present']`, `integration_identifier`, `/v2/core/accounts`) plus explicit deprecated patterns to avoid (`stripe.api_key = …`, `Stripe.setApiKey`). This matches the 'fully executable, covers common cases' anchor rather than 4, since no stated guidance is vague or gapped — common cases are delegated to concrete reference files.

5 / 5

Workflow Clarity

The integration-routing table is an unambiguous decision structure and real checkpoints exist ("Before enabling `automatic_tax: { enabled: true }` … read the tax reference and confirm the user has an active registration", "Read the relevant reference file before answering any integration question or writing code"). It is not 5 because there is no end-to-end sequenced workflow for a new integration (environment → sandbox/keys → API choice → implement → webhooks) and no error-recovery/feedback loops.

4 / 5

Progressive Disclosure

The body is a clear overview that routes each task to one of six one-level-deep reference files (references/payments.md, connect.md, billing.md, tax.md, treasury.md, security.md), all of which exist in the bundle and link outward to Stripe docs rather than nesting further. Navigation is easy via the routing table; the only nit is the `<references/payments.md>` pseudo-link syntax instead of markdown links, which does not impair discoverability.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong frontmatter description: it comprehensively names concrete Stripe capabilities, gives an explicit 'Use when' clause with natural trigger phrases and their synonyms, and occupies a distinct Stripe-only niche in third-person voice. Every clause carries either a capability or a trigger, so despite its length it is not padded.

DimensionReasoningScore

Specificity

The description enumerates many concrete capabilities with named specifics: "API selection (Checkout Sessions vs PaymentIntents)", "Connect platform setup (Accounts v2, controller properties)", "tax and registrations (Stripe Tax, automatic_tax, product tax codes)", "security best practices (API key management, API key permissions, webhooks, OAuth)", "migrating from deprecated Stripe APIs". Coverage is comprehensive across the Stripe domain, matching the 'multiple specific concrete actions; comprehensive coverage' anchor rather than 4's 'minor gaps in coverage'.

5 / 5

Completeness

It explicitly answers both questions: what — "Guides Stripe integration decisions across development and test environment planning… migrating from deprecated Stripe APIs, and security best practices"; and when — "Use when planning, building, modifying, testing, or reviewing any Stripe integration, including…". Both are concrete and explicit, matching the top anchor; score 4's weaker 'when' does not apply.

5 / 5

Trigger Term Quality

The 'Use when' clause packs natural phrases users would actually say: "accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, collecting sales tax, VAT, or GST, creating connected accounts, or implementing secure key handling", plus planning/building/modifying/testing/reviewing verbs. Synonyms and regional variants (sales tax, VAT, GST; marketplaces and connected accounts) are present, so no common natural terms are missing.

5 / 5

Distinctiveness Conflict Risk

The niche is clearly Stripe integration with Stripe-specific triggers ("Checkout Sessions vs PaymentIntents", "Accounts v2", "Stripe Tax", "connected accounts", "VAT, or GST"), so it is unlikely to fire for a non-Stripe skill. It is written in third person ("Guides…"), so the voice penalty does not apply.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

stripe/ai

Path

skills/stripe-best-practices/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.