技能 convex-billing

📦

convex-billing

Name: convex-billing
Author: get-convex

内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问🔑 环境变量

Add Stripe Billing to Convex

Subscription billing requires coordinated checkout, webhook, and access-control logic. This skill provides a focused Convex workflow using the maintained Stripe component.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "convex-billing" from https://skillstore.io/skills/get-convex-convex-billing.md and its manifest at https://skillstore.io/api/skills/get-convex-convex-billing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/get-convex-convex-billing.md 已签名 manifest GET /api/skills/get-convex-convex-billing/manifest 已签名 lockfile GET /api/skills/get-convex-convex-billing/lockfile

测试它

正在使用“convex-billing”。 Add subscription billing with Basic and Pro plans.

预期结果:

Registers the Stripe component and webhook route.
Creates authenticated checkout for server-approved Basic and Pro prices.
Adds a query that returns the current subscription state.

正在使用“convex-billing”。 Check whether my billing setup is ready for production.

预期结果:

Confirms webhook signing and protected secret storage.
Flags client-controlled price identifiers for server-side validation.
Verifies the deployment URL and paid-feature authorization rules.

安全审计

高风险

v1 • 2026/9/7 打开版本化报告

The skill legitimately invokes npm and npx to install dependencies and deploy Convex functions. Most static detections are Markdown or configuration references, but the checkout example trusts a client-supplied Stripe price identifier without server-side validation.

已扫描文件

分析行数

复核项

已忽略误报

已确认安全问题 (1)

高

SKILL.md:40-47

Unvalidated Client-Supplied Stripe Price

The checkout action accepts priceId from an authenticated client and sends it directly to Stripe. A user could select an unintended or lower-priced product.

The action declares priceId as client input and passes it unchanged into createCheckoutSession. No server-side plan mapping or allowlist appears in the example.

能力复核项 (2)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中

SKILL.md:14

Ruby/shell backtick execution

1. Install the component: `npm install @convex-dev/stripe`.

Line 14 instructs the agent to run npm install, which executes package lifecycle code and changes project dependencies. This is expected for the workflow but remains external command execution.

中

SKILL.md:61

Ruby/shell backtick execution

6. Run `npx convex dev --once` — it will install the component and push the functions. Verify output

Line 61 instructs the agent to run npx convex dev, which executes a package CLI and pushes functions to a selected Convex deployment.

风险因素

⚙️ 外部命令 (14)

SKILL.md:14 SKILL.md:15 SKILL.md:16-22 SKILL.md:22-23 SKILL.md:23 SKILL.md:24-25 SKILL.md:25-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-47 SKILL.md:47 SKILL.md:60-61 SKILL.md:61 SKILL.md:62

🌐 网络访问 (2)

SKILL.md:47 SKILL.md:62

🔑 环境变量 (4)

SKILL.md:47 SKILL.md:47 SKILL.md:23 SKILL.md:67

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/get-convex-convex-billing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/get-convex-convex-billing/security.svg)](https://skillstore.io/skills/get-convex-convex-billing?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/get-convex-convex-billing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/get-convex-convex-billing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/get-convex-convex-billing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

get-convex. (2026). convex-billing security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/get-convex-convex-billing/audits/1

BibTeX 引用

@techreport{get-convex-get-convex-convex-billing-2026,
  author = {get-convex},
  title = {convex-billing security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/get-convex-convex-billing/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "convex-billing security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "get-convex"
date-released: "2026-09-07"
url: "https://skillstore.io/skills/get-convex-convex-billing/audits/1"
identifiers:
  - type: other
    value: "skillstore:get-convex-convex-billing:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Launch SaaS Subscriptions

Add authenticated Stripe checkout and subscription access checks to an existing Convex product.

Standardize Billing Integration

Create a consistent Stripe component setup across Convex projects and deployment environments.

Review Subscription Architecture

Compare an existing billing implementation with component-managed webhooks and server-stored subscription state.

试试这些提示

Add Basic Billing

Add Stripe subscription billing to my Convex application. Show the files to change and use authenticated users for customer records.

Configure Checkout

Create a subscription checkout action for these approved plans: [PLAN NAMES]. Keep Stripe price IDs in server-controlled configuration.

Add Subscription Gating

Add server-side subscription checks for [FEATURE]. Distinguish active, trialing, canceled, and expired access according to these rules: [RULES].

Audit Billing Integration

Review my Convex Stripe integration for price validation, webhook verification, customer ownership, redirect configuration, and plan-specific entitlements. Propose focused corrections.

最佳实践

Keep Stripe secrets in Convex environment storage and use separate test and production values.
Map plan names to approved Stripe price IDs on the server.
Gate paid features with server-stored subscription state instead of client claims.

避免

Do not trust arbitrary price IDs supplied by clients.
Do not implement webhook signature verification manually when the component already provides it.
Do not grant access from client-side payment state or checkout success parameters.

常见问题

Does this skill support Stripe subscriptions?

Yes. It creates subscription checkout and checks active or trialing subscription state stored by the Convex component.

Does it support one-time payments?

No. The provided workflow uses subscription mode and requires adaptation for one-time payment flows.

Where should Stripe secrets be stored?

Store STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET in Convex environment storage. Never place live values in source files.

Does the webhook verify Stripe signatures?

Yes. The registered @convex-dev/stripe route handles signature verification when configured with the correct webhook secret.

Can clients choose any Stripe price?

The sample permits this, but production code should map approved plans to price IDs on the server.

How does the skill protect paid features?

It queries component-managed subscription records for the authenticated user. Applications should extend this check for plan-specific entitlements.

开发者详情

作者

get-convex

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/get-convex/agent-skills/tree/c41ece22681a50d326e54f30d24148a6d46d0c3c/skills/convex-billing

引用

d9e5ab86dafd32a1ddde9b8b4fde177589b55b95

维护新鲜度

2026/9/8

使用量

0 次下载 · 0 次浏览

文件结构

📄 SKILL.md