Fähigkeiten convex-billing
📦

convex-billing

Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle🌐 Netzwerkzugriff🔑 Umgebungsvariablen

Add Stripe Billing to Convex

Subscription billing requires coordinated checkout, webhook, and access-control logic. This skill provides a focused Convex workflow using the maintained Stripe component.

Unterstützt: Claude Codex Code(CC)
⚠️ 38 Schlecht

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage
Review the Skillstore skill "convex-billing" from https://skillstore.io/skills/get-convex-convex-billing.md and its manifest at https://skillstore.io/api/skills/get-convex-convex-billing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/get-convex-convex-billing.md Signiertes manifest GET /api/skills/get-convex-convex-billing/manifest Signiertes lockfile GET /api/skills/get-convex-convex-billing/lockfile

Testen

„convex-billing“ wird verwendet. Add subscription billing with Basic and Pro plans.

Erwartetes Ergebnis:

  • Registers the Stripe component and webhook route.
  • Creates authenticated checkout for server-approved Basic and Pro prices.
  • Adds a query that returns the current subscription state.

„convex-billing“ wird verwendet. Check whether my billing setup is ready for production.

Erwartetes Ergebnis:

  • Confirms webhook signing and protected secret storage.
  • Flags client-controlled price identifiers for server-side validation.
  • Verifies the deployment URL and paid-feature authorization rules.

Sicherheitsaudit

Hohes Risiko
v1 • 7.9.2026 Versionsbericht öffnen

The skill legitimately invokes npm and npx to install dependencies and deploy Convex functions. Most static detections are Markdown or configuration references, but the checkout example trusts a client-supplied Stripe price identifier without server-side validation.

1
Gescannte Dateien
70
Analysierte Zeilen
2
Prüfelemente
0
Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Hoch
SKILL.md:40-47
Unvalidated Client-Supplied Stripe Price
The checkout action accepts priceId from an authenticated client and sends it directly to Stripe. A user could select an unintended or lower-priced product.
The action declares priceId as client input and passes it unchanged into createCheckoutSession. No server-side plan mapping or allowlist appears in the example.
Elemente der Fähigkeitsprüfung (2)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel
SKILL.md:14
Ruby/shell backtick execution
1. Install the component: `npm install @convex-dev/stripe`.
Line 14 instructs the agent to run npm install, which executes package lifecycle code and changes project dependencies. This is expected for the workflow but remains external command execution.
Mittel
SKILL.md:61
Ruby/shell backtick execution
6. Run `npx convex dev --once` — it will install the component and push the functions. Verify output
Line 61 instructs the agent to run npx convex dev, which executes a package CLI and pushes functions to a selected Convex deployment.

Risikofaktoren

⚙️ Externe Befehle (14)
SKILL.md:14 SKILL.md:15 SKILL.md:16-22 SKILL.md:22-23 SKILL.md:23 SKILL.md:24-25 SKILL.md:25-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-47 SKILL.md:47 SKILL.md:60-61 SKILL.md:61 SKILL.md:62
🌐 Netzwerkzugriff (2)
SKILL.md:47 SKILL.md:62
🔑 Umgebungsvariablen (4)
SKILL.md:47 SKILL.md:47 SKILL.md:23 SKILL.md:67
Geprüft von: codex
Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen
Sicherheitsbewertung

Berichtslink kopieren

https://skillstore.io/skills/get-convex-convex-billing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/get-convex-convex-billing/security.svg)](https://skillstore.io/skills/get-convex-convex-billing?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/get-convex-convex-billing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/get-convex-convex-billing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/get-convex-convex-billing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

get-convex. (2026). convex-billing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/get-convex-convex-billing/audits/1

BibTeX-Zitat

@techreport{get-convex-get-convex-convex-billing-2026, author = {get-convex}, title = {convex-billing security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/get-convex-convex-billing/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "convex-billing security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "get-convex" date-released: "2026-09-07" url: "https://skillstore.io/skills/get-convex-convex-billing/audits/1" identifiers: - type: other value: "skillstore:get-convex-convex-billing:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel
55
Architektur
85
Wartbarkeit
87
Inhalt
65
Gemeinschaft
83
Spezifikationskonformität

Was Sie erstellen können

Launch SaaS Subscriptions

Add authenticated Stripe checkout and subscription access checks to an existing Convex product.

Standardize Billing Integration

Create a consistent Stripe component setup across Convex projects and deployment environments.

Review Subscription Architecture

Compare an existing billing implementation with component-managed webhooks and server-stored subscription state.

Diese Prompts ausprobieren

Add Basic Billing 
Add Stripe subscription billing to my Convex application. Show the files to change and use authenticated users for customer records.
Configure Checkout 
Create a subscription checkout action for these approved plans: [PLAN NAMES]. Keep Stripe price IDs in server-controlled configuration.
Add Subscription Gating 
Add server-side subscription checks for [FEATURE]. Distinguish active, trialing, canceled, and expired access according to these rules: [RULES].
Audit Billing Integration 
Review my Convex Stripe integration for price validation, webhook verification, customer ownership, redirect configuration, and plan-specific entitlements. Propose focused corrections.

Bewährte Praktiken

  • Keep Stripe secrets in Convex environment storage and use separate test and production values.
  • Map plan names to approved Stripe price IDs on the server.
  • Gate paid features with server-stored subscription state instead of client claims.

Vermeiden

  • Do not trust arbitrary price IDs supplied by clients.
  • Do not implement webhook signature verification manually when the component already provides it.
  • Do not grant access from client-side payment state or checkout success parameters.

Häufig gestellte Fragen

Does this skill support Stripe subscriptions?
Yes. It creates subscription checkout and checks active or trialing subscription state stored by the Convex component.
Does it support one-time payments?
No. The provided workflow uses subscription mode and requires adaptation for one-time payment flows.
Where should Stripe secrets be stored?
Store STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET in Convex environment storage. Never place live values in source files.
Does the webhook verify Stripe signatures?
Yes. The registered @convex-dev/stripe route handles signature verification when configured with the correct webhook secret.
Can clients choose any Stripe price?
The sample permits this, but production code should map approved plans to price IDs on the server.
How does the skill protect paid features?
It queries component-managed subscription records for the authenticated user. Applications should extend this check for plan-specific entitlements.

Entwicklerdetails

Lizenz

MIT

Skillstore-Revision

r1

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/get-convex/agent-skills/tree/c41ece22681a50d326e54f30d24148a6d46d0c3c/skills/convex-billing

Ref.

d9e5ab86dafd32a1ddde9b8b4fde177589b55b95

Aktualität der Wartung

8.9.2026

Nutzung

1 Downloads · 0 Aufrufe

Dateistruktur

📄 SKILL.md