CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/stripe-test-cards-and-webhooks

Wraps Stripe API testing patterns: test-mode initialization, the canonical test cards (4242 success; 4000 0000 0000 0002 declined; 4000 0027 6000 3184 3DS challenge per the 3DS flows reference in payment-flow-states-reference), the Stripe CLI webhook flow (`stripe listen --forward-to`), the Stripe CLI fixture commands (`stripe trigger payment_intent.succeeded`), and the webhook signature verification (Stripe-Signature header + HMAC-SHA256). Use when testing Stripe-integrated code.

65

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A solid, code-first skill body: nearly everything is executable, organized into scannable sections, and free of filler. Its weaknesses are small — two placeholder code snippets, no explicit validation/retry loop for webhook-signature failures, and companion-skill references that lack paths. Addressing the placeholders and adding a short failure-handling note would lift it to top marks.

Suggestions

Replace the '{...}' placeholders with runnable values: use a full example payload in the webhook test (e.g., data: { object: { id: 'pi_test', status: 'succeeded' } }) and concrete PaymentIntent parameters in the idempotency example.

Add an explicit validation/feedback step for webhook tests, e.g., 'if the handler returns non-200, check the raw-body middleware and confirm the CLI signing secret (from stripe listen --print-secret) matches STRIPE_WEBHOOK_SECRET'.

Give companion references actionable pointers — either file paths for payment-flow-states-reference / payment-flow-test-author or a one-line note on when to consult each — so navigation between the related skills is unambiguous.

DimensionReasoningScore

Conciseness

The body is dominated by executable code, a test-card table, and an anti-pattern table with essentially no padding or explanation of concepts Claude already knows. Minor trim opportunities remain: 'Per docs.stripe.com/testing' is stated twice, 'stripe listen --forward-to' appears in both Authoring and Running, and the '3DS flows reference' clause in 'When to use' duplicates the frontmatter — matching the 'efficient; minor instances that could be trimmed' anchor rather than the lean-everything-earns-its-place anchor.

4 / 5

Actionability

Most guidance is copy-paste ready: install commands, Stripe initialization, PaymentIntent test cases with assertions, 'stripe listen'/'stripe trigger' commands, and a CI YAML job. However two snippets contain '{...}' placeholders that are not valid JavaScript as written (the webhook test payload 'data: {...}' and the idempotency example 'stripe.paymentIntents.create({...})'), so it fits 'mostly executable; minor gaps' rather than fully copy-paste ready.

4 / 5

Workflow Clarity

Sections are sequenced logically (Install → obtain test keys → Initialize → card/PaymentIntent tests → webhook handler test → CLI forwarding → Running → CI), and the test assertions act as implicit validation checkpoints. But there is no explicit step numbering or validate/fix/retry guidance (e.g., what to check when the webhook handler returns non-200, or how to confirm the CLI signing secret is the local one), matching the 'clear sequence with minor validation gaps' anchor rather than the explicit-validation anchor.

4 / 5

Progressive Disclosure

No bundle files exist (references/, scripts/, assets/ are absent), and the single-file structure is well organized with clear headers; the inline test-card catalog and anti-pattern table are the skill's core value so inlining is defensible. The References section lists external Stripe docs clearly, but companion skills ('payment-flow-states-reference', 'payment-flow-test-author', 'payment-gateway-sandboxes') are name-dropped without paths or navigation context — good structure with minor organization gaps, matching the 4 anchor.

4 / 5

Total

16

/

20

Passed

Description

80%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it enumerates concrete, command-level capabilities in third person and closes with an explicit 'Use when' trigger. Its main gap is a single, somewhat narrow trigger phrase and a few missing natural synonyms that would widen when users' phrasing diverges from 'testing Stripe-integrated code'.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions with actual commands: 'test-mode initialization', 'canonical test cards (4242 success; 4000 0000 0000 0002 declined; 4000 0027 6000 3184 3DS challenge)', 'stripe listen --forward-to', 'stripe trigger payment_intent.succeeded', and 'webhook signature verification (Stripe-Signature header + HMAC-SHA256)'. This matches the anchor for comprehensive, specific concrete actions; nothing is vague or generic.

5 / 5

Completeness

Both 'what' ('Wraps Stripe API testing patterns: ...' with enumerated capabilities) and 'when' ('Use when testing Stripe-integrated code') are present, so it clears the missing-trigger cap. However the 'when' clause is a single narrow phrase and could be more explicit (e.g., enumerating webhook-handler tests, 3DS flows, declined-card cases), matching the anchor where 'when' could be more specific rather than the top anchor with multiple concrete trigger phrases.

4 / 5

Trigger Term Quality

Good natural keyword coverage: 'Stripe', 'test cards', 'webhook', '3DS challenge', 'testing', 'Stripe-integrated code'. A few natural user phrasings are missing (e.g., 'payment testing', 'sandbox', 'local webhook testing'), so it fits the 'good coverage; a few natural terms missing' anchor rather than the comprehensive one.

4 / 5

Distinctiveness Conflict Risk

It occupies a clear Stripe-testing niche with distinct triggers (specific card PANs, Stripe CLI commands, Stripe-Signature header), but it references sibling payment-testing skills ('payment-flow-states-reference', and the body names 'payment-gateway-sandboxes' / 'payment-flow-test-author') with which it could overlap for generic payment-testing requests — mostly distinct with minor overlap risk, matching the 4 anchor.

4 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents