stripe-integration
Implement Stripe payment processing for robust, PCI-compliant payment flows including checkout, subscriptions, and webhooks. Use when integrating Stripe payments, building subscription systems, or implementing secure checkout flows.
76
—
Does it follow best practices?
Impact
—
No eval scenarios have been run
Risky
Do not use without reviewing
Security
2 findings — 1 high severity, 1 medium severity. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
Insecure credential handling detected (high risk: 0.80). The prompt shows and encourages embedding API keys directly in code (e.g., stripe.api_key = "sk_test_...") and includes literal test credentials/card numbers, which leads the LLM to produce outputs containing secret values verbatim.
W009: Direct money access capability detected (payment gateways, crypto, banking)
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
Direct money access detected (high risk: 1.00). The skill is explicitly built for Stripe payment processing and contains concrete, actionable APIs and code to create and confirm payments, manage subscriptions, process refunds, handle webhooks for payment events, and manage customer payment methods. Examples include stripe.api_key usage, stripe.checkout.Session.create, stripe.PaymentIntent.create and confirm, and mention of refunds/disputes and Stripe Connect marketplace flows. This is a payment gateway integration designed to move money, so it grants direct financial execution authority.
- Repository
- wshobson/agents
- Commit
5cc2549
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.