Skills extension-stripe

📦

extension-stripe

Name: extension-stripe
Author: caffeinelabs

v0.1.6 Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Build Stripe Checkout for Caffeine AI

Adding card payments requires coordinated backend, frontend, and routing work. This skill provides a practical Stripe Checkout pattern for Caffeine AI applications.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "extension-stripe" from https://skillstore.io/skills/caffeinelabs-extension-stripe.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-extension-stripe/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/caffeinelabs-extension-stripe.md Signed manifest GET /api/skills/caffeinelabs-extension-stripe/manifest Signed lockfile GET /api/skills/caffeinelabs-extension-stripe/lockfile

Test it

Using "extension-stripe". Plan Stripe Checkout for a small digital product store.

Expected outcome:

Store product identifiers and prices in the backend.
Accept only product identifiers and bounded quantities from the frontend.
Create Checkout sessions with backend-derived prices and allowlisted return URLs.
Verify completed sessions before delivering digital products.

Using "extension-stripe". Describe the expected checkout result handling.

Expected outcome:

Parse the session response, require a non-empty Stripe URL, show an error for invalid responses, and use full-page browser navigation.

Using "extension-stripe". Review the admin setup flow.

Expected outcome:

Restrict configuration changes to administrators, hide setup after configuration, protect the secret key, and validate allowed country codes.

Security Audit

High Risk

v3 • 7/23/2026 Open versioned report

All 25 static findings are false positives caused by Markdown syntax, ordinary imports, template literals, and an informational link. Semantic review found client-controlled pricing and redirect URLs in the recommended checkout design.

Files scanned

219

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:37-43 SKILL.md:134-136

Client-Controlled Checkout Pricing

The public checkout method forwards caller-supplied ShoppingItem values, including price and currency, directly to Stripe without loading authoritative product data.

The documented type exposes priceInCents and the backend passes the caller-provided item array directly into createCheckoutSession without product lookup or validation.

Medium

SKILL.md:134-136 SKILL.md:180-183

Unrestricted Checkout Redirect URLs

The public checkout method accepts success and cancellation URLs from callers without validating their schemes, hosts, ports, or paths.

The backend signature accepts both URLs as text and forwards them to Stripe without an allowlist; the frontend-generated values do not constrain direct backend callers.

Risk Factors

⚙️ External commands (21)

🌐 Network access (1)

SKILL.md:14

📁 Filesystem access (2)

SKILL.md:24 SKILL.md:167

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/caffeinelabs-extension-stripe/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-extension-stripe/security.svg)](https://skillstore.io/skills/caffeinelabs-extension-stripe?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/caffeinelabs-extension-stripe?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-extension-stripe/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-extension-stripe.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

caffeinelabs. (2026). extension-stripe security audit report (audit version 3) [Author version 0.1.6]. Skillstore. https://skillstore.io/skills/caffeinelabs-extension-stripe/audits/3

BibTeX citation

@techreport{caffeinelabs-caffeinelabs-extension-stripe-2026,
  author = {caffeinelabs},
  title = {extension-stripe security audit report (audit version 3)},
  institution = {Skillstore},
  year = {2026},
  number = {3},
  url = {https://skillstore.io/skills/caffeinelabs-extension-stripe/audits/3},
  note = {Author version 0.1.6}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "extension-stripe security audit report (audit version 3)"
version: "0.1.6"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/caffeinelabs-extension-stripe/audits/3"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-extension-stripe:audit:3"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add Checkout to a Store

Create backend sessions and frontend redirects for products sold through a Caffeine AI application.

Configure Stripe Administration

Build an admin-only setup view for a Stripe secret key and allowed countries.

Review a Payment Integration

Compare an existing Motoko and React payment flow with the documented integration pattern.

Try These Prompts

Plan a Basic Checkout

Plan a Stripe Checkout flow for my Caffeine AI app. My products are [product types] and my frontend uses [framework].

Build the Backend

Implement the Motoko Stripe backend for [project]. Use backend product records, admin-only configuration, and fixed allowlisted redirect origins.

Build the Frontend Flow

Create React checkout, success, and failure components for [project]. Validate session responses and show clear loading and error states.

Audit the Complete Integration

Audit my Stripe integration for price tampering, redirect abuse, secret exposure, session verification, duplicate fulfillment, and authorization gaps. Propose specific fixes.

Best Practices

Load prices, names, and currencies from trusted backend product records.
Allowlist return origins and verify Stripe session status before fulfillment.
Keep Stripe configuration changes behind explicit administrator authorization.

Avoid

Do not trust prices or currencies sent by the browser.
Do not accept unrestricted success or cancellation URLs from callers.
Do not grant products from a success page without server-side payment verification.

Frequently Asked Questions

Which payment methods does this skill cover?

It focuses on Stripe Checkout for credit and debit card payments.

Which backend language does the example use?

The backend example uses Motoko with Caffeine AI Stripe, authorization, and HTTP outcall packages.

Does the skill include frontend guidance?

Yes. It covers React Query checkout handling, browser redirects, result components, and TanStack Router paths.

Does it secure product prices automatically?

No. You must load authoritative prices on the backend instead of trusting browser-supplied values.

How should payment completion be verified?

Check the Stripe session status on the backend before granting an order, download, subscription, or entitlement.

What must be installed first?

Complete the Caffeine AI authorization extension, then add the required Stripe and HTTP outcall packages.

Developer Details

Author

caffeinelabs

License

MIT

Author version

v0.1.6

Skillstore revision

Repository

https://github.com/caffeinelabs/skills/tree/main/skills/extension-stripe/

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

0 downloads · 0 views

File structure

📄 SKILL.md