Skills stripe-integration

📦

stripe-integration

Name: stripe-integration
Author: sickn33

Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Implement Stripe Payments Safely

Payment integrations require secure checkout, webhook handling, and subscription logic. This skill guides Stripe implementations with practical patterns, testing advice, and operational safeguards.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "stripe-integration" from https://skillstore.io/skills/sickn33-stripe-integration.md and its manifest at https://skillstore.io/api/skills/sickn33-stripe-integration/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-stripe-integration.md Signed manifest GET /api/skills/sickn33-stripe-integration/manifest Signed lockfile GET /api/skills/sickn33-stripe-integration/lockfile

Test it

Using "stripe-integration". A request to choose between hosted Checkout and Payment Intents.

Expected outcome:

Recommended flow: hosted Checkout for the first release.
Reason: it lowers PCI scope and supports fast payment validation.
Next steps: create a session, configure callback URLs, and verify webhooks.

Using "stripe-integration". A request to harden webhook processing.

Expected outcome:

Verify signatures with the Stripe SDK.
Store processed event identifiers before fulfillment.
Retry failed work with clear alerts and audit logs.

Using "stripe-integration". A request to plan subscription billing.

Expected outcome:

Model products and prices before implementation.
Use default incomplete subscriptions for SCA support.
Handle subscription updates, cancellations, and invoice payment results.

Security Audit

High Risk

v5 • 7/9/2026 Open versioned report

Most static alerts are false positives caused by Markdown backticks, placeholder callback URLs, and normal webhook or customer identifiers. I confirmed the hardcoded Stripe secret-key examples as unsafe guidance and added semantic findings for webhook secret handling and manual verification. No prompt injection, malicious exfiltration, or shell execution intent was found.

Files scanned

455

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:289-297

Incomplete Manual Webhook Verification Example

The manual verification helper calculates a raw HMAC over the payload and compares one signature. It omits header parsing, timestamp checks, and replay tolerance.

The helper is presented as webhook best practice and lacks replay handling. The skill also shows the safer SDK verifier earlier.

Medium

SKILL.md:227

Hardcoded Webhook Secret Placeholder

The webhook example assigns endpoint_secret = 'whsec_...' in copyable source. This can teach users to commit webhook signing secrets.

The line directly stores a webhook signing secret placeholder in source. The issue is documentation guidance, not an exposed real secret.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:79

Generic API/secret keys

stripe.api_key = "sk_test_..."

The Quick Start assigns a Stripe secret-key placeholder directly in copyable source. It is not an exposed real key, but it teaches hardcoded payment credentials.

High

SKILL.md:392

Generic API/secret keys

stripe.api_key = "sk_test_..."

The testing section repeats a hardcoded Stripe secret-key placeholder. Even for test mode, the safer pattern is environment or secret-manager loading.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-stripe-integration/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-stripe-integration/security.svg)](https://skillstore.io/skills/sickn33-stripe-integration?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-stripe-integration?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-stripe-integration/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-stripe-integration.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). stripe-integration security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-stripe-integration/audits/5

BibTeX citation

@techreport{sickn33-sickn33-stripe-integration-2026,
  author = {sickn33},
  title = {stripe-integration security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-stripe-integration/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "stripe-integration security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-stripe-integration/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-stripe-integration:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

wshobson Recommended

wshobson-stripe-integration

Skillstore Score 69

Evidence Confidence High

Skillstore usage 11

Updated

2026-08-21

sickn33 Current

sickn33-stripe-integration

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Launch Subscription Billing

Plan products, prices, checkout sessions, payment confirmation, and cancellation handling for a SaaS subscription flow.

Harden Webhook Processing

Review webhook event coverage, signature verification, idempotency, retries, and fulfillment timing.

Manage Payment Operations

Design refund, dispute, customer portal, and saved payment method workflows for support teams.

Try These Prompts

Choose a Payment Flow

Explain which Stripe payment flow fits a simple one-time purchase. Include required backend steps, frontend steps, and testing checks.

Design Subscription Checkout

Design a hosted Checkout subscription flow for my SaaS product. Include products, prices, success handling, cancellation handling, and webhooks.

Review Webhook Safety

Review my Stripe webhook plan for missed events, idempotency gaps, error handling, and customer access updates.

Plan Marketplace Payments

Create an implementation plan for a marketplace using Stripe Connect, saved payment methods, refunds, disputes, and compliance checkpoints.

Best Practices

Use hosted Checkout when custom card handling is not required.
Verify webhook signatures and process events idempotently before fulfillment.
Keep Stripe keys and webhook secrets in managed secrets, not source files.

Avoid

Do not rely only on client redirects to mark payments as complete.
Do not store raw card data or send it through your backend.
Do not copy placeholder keys or callback URLs into production.

Frequently Asked Questions

Does this skill build a complete Stripe app?

No. It gives implementation patterns and review guidance for your existing app.

Can it help with subscriptions?

Yes. It covers products, prices, subscriptions, invoices, customer portals, and lifecycle events.

Does it reduce PCI scope?

It recommends hosted Checkout and Stripe.js patterns that keep raw card data away from your server.

Can it review webhook handling?

Yes. It can check event coverage, signature verification, idempotency, retries, and access updates.

Does it include testing guidance?

Yes. It references test mode, test cards, failed payments, and 3D Secure scenarios.

Should I still read Stripe documentation?

Yes. Use current Stripe documentation for API version details, compliance requirements, and regional payment rules.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/stripe-integration

Ref

26421118b848d9f1efc0aa169d8a7a9e7e0a877e

Maintenance freshness

7/18/2026

Usage

8 downloads · 155 views

File structure

📄 SKILL.md