{"data":{"skill":{"slug":"caffeinelabs-extension-stripe","name":"extension-stripe","icon":"📦","repo":"https://github.com/caffeinelabs/skills/tree/main/skills/extension-stripe/","status":"approved","author":"caffeinelabs","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"8d4a469f-9263-4672-bfdc-3fbad5b63720","skill_id":"ff5262de-4fad-48bb-b7ab-bbc08a9632ba","version":1,"content_hash":"v2:b2036d7931ef61c79ffdf43dae2a82ea8514f89a:baec7b5f539d0f5841bc33f2f5d0a67077f1924acbc839cd57c924701a766e94:880119c0ffaa91e99f1b2c0499b4521c8ea9fd5a40cf78c625362a5117fd798a:cb16ea01b16cb9f13caffff58108ca5e","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"I found no confirmed security issues. The static findings are false positives from Markdown fences, inline code, JavaScript template literals, documentation links, relative imports, and a sample product id field. No prompt injection or data exfiltration intent was found in SKILL.md.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":57,"line_start":28},{"file":"SKILL.md","line_end":61,"line_start":57},{"file":"SKILL.md","line_end":144,"line_start":61},{"file":"SKILL.md","line_end":153,"line_start":144},{"file":"SKILL.md","line_end":153,"line_start":153},{"file":"SKILL.md","line_end":161,"line_start":155},{"file":"SKILL.md","line_end":162,"line_start":161},{"file":"SKILL.md","line_end":164,"line_start":162},{"file":"SKILL.md","line_end":180,"line_start":164},{"file":"SKILL.md","line_end":181,"line_start":180},{"file":"SKILL.md","line_end":182,"line_start":181},{"file":"SKILL.md","line_end":193,"line_start":182},{"file":"SKILL.md","line_end":196,"line_start":193},{"file":"SKILL.md","line_end":197,"line_start":196},{"file":"SKILL.md","line_end":198,"line_start":197},{"file":"SKILL.md","line_end":199,"line_start":198},{"file":"SKILL.md","line_end":200,"line_start":199},{"file":"SKILL.md","line_end":201,"line_start":200},{"file":"SKILL.md","line_end":201,"line_start":201},{"file":"SKILL.md","line_end":207,"line_start":203}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":167,"line_start":167}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":219,"audit_model":"codex","audited_at":"2026-07-07T12:37:47.295+00:00","created_at":"2026-07-07T13:06:45.295305+00:00","static_findings":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"There is the prefabricated module `mo:caffeineai-stripe/stripe.mo` that that cannot be modified. It ","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```mo:caffeineai-stripe/stripe.mo","category":"external_commands","line_end":57,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":61,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```motoko filepath=src/backend/main.mo","category":"external_commands","line_end":144,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":153,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* Use `isStripeConfigured()` and `setStripeConfiguration()`","category":"external_commands","line_end":153,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* If not, opens an admin panel and asks the user to initialze Stripe with `StripeConfiguration`.","category":"external_commands","line_end":161,"severity":"medium","line_start":155},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* Note that JSON parsing of backend `createCheckoutSession` result is needed.","category":"external_commands","line_end":162,"severity":"medium","line_start":161},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* Validate that the parsed session includes a non-empty `url`. If missing, throw an error and do not","category":"external_commands","line_end":164,"severity":"medium","line_start":162},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":180,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"const baseUrl = `${window.location.protocol}//${window.location.host}`;","category":"external_commands","line_end":181,"severity":"medium","line_start":180},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"const successUrl = `${baseUrl}/payment-success`;","category":"external_commands","line_end":182,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"const cancelUrl = `${baseUrl}/payment-failure`;","category":"external_commands","line_end":193,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":196,"severity":"medium","line_start":193},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* `useCreateCheckoutSession()`","category":"external_commands","line_end":197,"severity":"medium","line_start":196},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* Pass `ShoppingItem[]` as input.","category":"external_commands","line_end":198,"severity":"medium","line_start":197},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* Anaylze the `CheckoutSession` result.","category":"external_commands","line_end":199,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* Redirect webpage to url in `CheckoutSession`: This allows the user to complete the payment.","category":"external_commands","line_end":200,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* Do NOT use router navigation for the Stripe URL. Use `window.location.href`.","category":"external_commands","line_end":201,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"* Never navigate to `/undefined`; if `session.url` is missing, show an error and stop.","category":"external_commands","line_end":201,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":207,"severity":"medium","line_start":203},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Stripe payment extension for [Caffeine AI](https://caffeine.ai?utm_source=caffeine-skill&utm_medium=","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"filesystem:SKILL.md:24:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Prerequisite: You must follow [extension-authorization](../extension-authorization/SKILL.md) first, ","category":"filesystem","line_end":24,"severity":"high","line_start":24},{"id":"filesystem:SKILL.md:167:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"import { ShoppingItem } from '../backend';","category":"filesystem","line_end":167,"severity":"high","line_start":167},{"id":"blocker:SKILL.md:78:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"id : Text;","category":"blocker","line_end":78,"severity":"low","line_start":78}],"finding_verdicts":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The match is inline Markdown around a Motoko module path, not Ruby or shell backtick execution. It documents an imported payment module and does not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The match is the opening Markdown code fence for a Motoko module declaration. It is documentation syntax, not a command execution primitive.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The match is the closing Markdown code fence after the Motoko module example. It cannot execute shell commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The match is the opening Markdown code fence for sample backend Motoko code. It is not Ruby backtick execution or a shell call.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"The match is the closing Markdown code fence for the backend sample. There is no command invocation at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"The match is inline Markdown around function names used by the app. It references backend APIs and does not invoke an external command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","reason":"The match is inline Markdown around a Stripe configuration type. It is prose documentation, not executable shell syntax.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"The match is inline Markdown around createCheckoutSession in frontend instructions. It names an API result and does not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"The match is inline Markdown around the url field in validation guidance. It does not represent shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The match is the opening Markdown code fence for a TypeScript checkout hook example. It is documentation syntax, not command execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","reason":"The match is a JavaScript template literal that builds the current browser origin. It does not spawn a process or evaluate shell input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"The match is a JavaScript template literal that appends a success route to the app origin. It does not execute an external command.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"The match is a JavaScript template literal that appends a failure route to the app origin. It is URL construction, not shell execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","reason":"The match is the closing Markdown code fence for the TypeScript hook sample. There is no executable command at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","reason":"The match is inline Markdown around the checkout hook name. It is a documentation reference and does not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","reason":"The match is inline Markdown around a TypeScript array type. It is type documentation, not command execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The match is inline Markdown around CheckoutSession in payment component instructions. It names a data type and does not invoke a shell.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"The match is inline Markdown around CheckoutSession in redirect guidance. It is not a shell command or process execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"The match is inline Markdown around window.location.href. It directs browser navigation and does not run an external command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"The match is inline Markdown around /undefined and session.url. It is validation guidance, not shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"The match is the opening Markdown code fence for a short TypeScript redirect example. It is documentation syntax and not executable shell code.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:14:hardcoded-url","reason":"The URL is a Markdown link to the Caffeine AI website in descriptive text. It is not a hidden network request or data exfiltration endpoint.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:24:path-traversal-sequence","reason":"The ../ sequence appears in a Markdown link to a prerequisite skill document. It is not used for filesystem reads, writes, or path traversal.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:167:path-traversal-sequence","reason":"The ../ sequence appears in a TypeScript relative import inside sample frontend code. It is a normal module import path, not runtime filesystem access.","verdict":"false_positive","confidence":0.93},{"id":"blocker:SKILL.md:78:system-reconnaissance","reason":"The text is a Product type field named id in Motoko sample code. It has no relationship to system reconnaissance or host inspection.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}