📦

convex-billing

Name: convex-billing
Author: get-convex

Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red🔑 Variables de entorno

Add Stripe Billing to Convex

Subscription billing requires coordinated checkout, webhook, and access-control logic. This skill provides a focused Convex workflow using the maintained Stripe component.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "convex-billing" from https://skillstore.io/skills/get-convex-convex-billing.md and its manifest at https://skillstore.io/api/skills/get-convex-convex-billing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/get-convex-convex-billing.md Manifest firmado GET /api/skills/get-convex-convex-billing/manifest Lockfile firmado GET /api/skills/get-convex-convex-billing/lockfile

Pruébalo

Usando "convex-billing". Add subscription billing with Basic and Pro plans.

Resultado esperado:

Registers the Stripe component and webhook route.
Creates authenticated checkout for server-approved Basic and Pro prices.
Adds a query that returns the current subscription state.

Usando "convex-billing". Check whether my billing setup is ready for production.

Resultado esperado:

Confirms webhook signing and protected secret storage.
Flags client-controlled price identifiers for server-side validation.
Verifies the deployment URL and paid-feature authorization rules.

Auditoría de seguridad

Riesgo alto

v1 • 7/9/2026 Abrir el informe versionado

The skill legitimately invokes npm and npx to install dependencies and deploy Convex functions. Most static detections are Markdown or configuration references, but the checkout example trusts a client-supplied Stripe price identifier without server-side validation.

Archivos escaneados

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Alto

SKILL.md:40-47

Unvalidated Client-Supplied Stripe Price

The checkout action accepts priceId from an authenticated client and sends it directly to Stripe. A user could select an unintended or lower-priced product.

The action declares priceId as client input and passes it unchanged into createCheckoutSession. No server-side plan mapping or allowlist appears in the example.

Elementos de revisión de capacidades (2)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

SKILL.md:14

Ruby/shell backtick execution

1. Install the component: `npm install @convex-dev/stripe`.

Line 14 instructs the agent to run npm install, which executes package lifecycle code and changes project dependencies. This is expected for the workflow but remains external command execution.

Medio

SKILL.md:61

Ruby/shell backtick execution

6. Run `npx convex dev --once` — it will install the component and push the functions. Verify output

Line 61 instructs the agent to run npx convex dev, which executes a package CLI and pushes functions to a selected Convex deployment.

Factores de riesgo

⚙️ Comandos externos (14)

SKILL.md:14 SKILL.md:15 SKILL.md:16-22 SKILL.md:22-23 SKILL.md:23 SKILL.md:24-25 SKILL.md:25-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-47 SKILL.md:47 SKILL.md:60-61 SKILL.md:61 SKILL.md:62

🌐 Acceso a red (2)

SKILL.md:47 SKILL.md:62

🔑 Variables de entorno (4)

SKILL.md:47 SKILL.md:47 SKILL.md:23 SKILL.md:67

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/get-convex-convex-billing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/get-convex-convex-billing/security.svg)](https://skillstore.io/skills/get-convex-convex-billing?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/get-convex-convex-billing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/get-convex-convex-billing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/get-convex-convex-billing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

get-convex. (2026). convex-billing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/get-convex-convex-billing/audits/1

Cita BibTeX

@techreport{get-convex-get-convex-convex-billing-2026,
  author = {get-convex},
  title = {convex-billing security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/get-convex-convex-billing/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "convex-billing security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "get-convex"
date-released: "2026-09-07"
url: "https://skillstore.io/skills/get-convex-convex-billing/audits/1"
identifiers:
  - type: other
    value: "skillstore:get-convex-convex-billing:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Launch SaaS Subscriptions

Add authenticated Stripe checkout and subscription access checks to an existing Convex product.

Standardize Billing Integration

Create a consistent Stripe component setup across Convex projects and deployment environments.

Review Subscription Architecture

Compare an existing billing implementation with component-managed webhooks and server-stored subscription state.

Prueba estos prompts

Add Basic Billing

Add Stripe subscription billing to my Convex application. Show the files to change and use authenticated users for customer records.

Configure Checkout

Create a subscription checkout action for these approved plans: [PLAN NAMES]. Keep Stripe price IDs in server-controlled configuration.

Add Subscription Gating

Add server-side subscription checks for [FEATURE]. Distinguish active, trialing, canceled, and expired access according to these rules: [RULES].

Audit Billing Integration

Review my Convex Stripe integration for price validation, webhook verification, customer ownership, redirect configuration, and plan-specific entitlements. Propose focused corrections.

Mejores prácticas

Keep Stripe secrets in Convex environment storage and use separate test and production values.
Map plan names to approved Stripe price IDs on the server.
Gate paid features with server-stored subscription state instead of client claims.

Evitar

Do not trust arbitrary price IDs supplied by clients.
Do not implement webhook signature verification manually when the component already provides it.
Do not grant access from client-side payment state or checkout success parameters.

Preguntas frecuentes

Does this skill support Stripe subscriptions?

Yes. It creates subscription checkout and checks active or trialing subscription state stored by the Convex component.

Does it support one-time payments?

No. The provided workflow uses subscription mode and requires adaptation for one-time payment flows.

Where should Stripe secrets be stored?

Store STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET in Convex environment storage. Never place live values in source files.

Does the webhook verify Stripe signatures?

Yes. The registered @convex-dev/stripe route handles signature verification when configured with the correct webhook secret.

Can clients choose any Stripe price?

The sample permits this, but production code should map approved plans to price IDs on the server.

How does the skill protect paid features?

It queries component-managed subscription records for the authenticated user. Applications should extend this check for plan-specific entitlements.

Detalles del desarrollador

Autor

get-convex

Licencia

MIT

Revisión de Skillstore

Aviso de versión

El autor no declaró una versión.

Repositorio

https://github.com/get-convex/agent-skills/tree/c41ece22681a50d326e54f30d24148a6d46d0c3c/skills/convex-billing

Ref.

d9e5ab86dafd32a1ddde9b8b4fde177589b55b95

Actualidad del mantenimiento

8/9/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md