技能 stripe-projects

📦

stripe-projects

Name: stripe-projects
Author: stripe

内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问

使用 Stripe Projects 预配服务

开发者通常需要数据库、身份验证、托管和 API 凭据，同时又不想离开编码工作流。此技能会引导 Claude、Codex 和 Claude Code 完成 Stripe Projects CLI 预配步骤。

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "stripe-projects" from https://skillstore.io/skills/stripe-stripe-projects.md and its manifest at https://skillstore.io/api/skills/stripe-stripe-projects/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/stripe-stripe-projects.md 已签名 manifest GET /api/skills/stripe-stripe-projects/manifest 已签名 lockfile GET /api/skills/stripe-stripe-projects/lockfile

测试它

正在使用“stripe-projects”。我的原型需要一个数据库。

预期结果:

该技能会搜索目录，确认可用的数据库提供商，在需要时初始化项目，并添加所选服务。

正在使用“stripe-projects”。已经连接了哪些服务？

预期结果:

该技能会检查项目状态，并仅报告提供商名称、服务类型、层级和环境变量名称。

正在使用“stripe-projects”。我需要一个电子邮件提供商的 API 密钥。

预期结果:

该技能会在目录中搜索电子邮件提供商，并启动已批准的预配或链接流程。

安全审计

高风险

v5 • 2026/7/7 打开版本化报告

Most Markdown backtick detections are false positives because they mark examples, tables, or fixed CLI commands. Real risks remain around package and plugin installation, project initialization, user-controlled CLI arguments, sensitive environment files, and a handoff to a locally installed skill. No prompt injection attempt was found in SKILL.md.

已扫描文件

133

分析行数

复核项

已忽略误报

已确认安全问题 (2)

高

SKILL.md:123

Environment file access

Only inspect `.projects/` or `.env` directly if the user explicitly asks you to — the CLI is authori

The line permits direct inspection of .projects or .env when the user asks. Those files may contain credentials, so outputs need strict redaction.

高

SKILL.md:85 SKILL.md:97

Unaudited Local Skill Handoff

The skill says project initialization installs stripe-projects-cli under .claude/skills, then tells the agent to invoke that local skill. That follow-on skill is not included in this marketplace report, so later instructions may be unaudited.

The handoff is explicit in SKILL.md and it changes the instruction set used after initialization. I did not inspect the generated local skill because it is not part of the provided static analysis.

能力复核项 (9)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

SKILL.md:97

Ruby/shell backtick execution

If `OK`: use the locally-installed `stripe-projects-cli` skill (invoke using the Skill tool with nam

The line tells the agent to invoke a locally installed skill. That skill is outside this audited package and can alter later agent behavior.

中

SKILL.md:42

Ruby/shell backtick execution

- **macOS (Homebrew):** `brew install stripe/stripe-cli/stripe` (or `brew upgrade stripe/stripe-cli/

The skill tells the agent to install or upgrade the Stripe CLI with Homebrew. Package installation changes the host and fetches software from outside the workspace.

中

SKILL.md:47-49

Ruby/shell backtick execution

```bash

The skill tells the agent to install the Stripe Projects plugin. Installing CLI plugins changes local tooling and executes third-party distributed code.

中

SKILL.md:55-57

Ruby/shell backtick execution

```bash

The command accepts a user-provided query placeholder. If an agent constructs it without quoting or validation, shell metacharacters in the query could be interpreted.

中

SKILL.md:77-79

Ruby/shell backtick execution

```bash

The skill instructs stripe projects init --yes, which mutates local project state and may trigger authentication. It should require explicit user consent.

中

SKILL.md:79-85

Ruby/shell backtick execution

```

The surrounding block documents that initialization may open a browser and install a local skill. Those side effects are real even though the matched token is a fence.

中

SKILL.md:85

Ruby/shell backtick execution

**Important:** `stripe projects init` installs the `stripe-projects-cli` skill locally at `.claude/s

The line states that initialization installs a local skill under .claude/skills. Adding executable agent instructions to the workspace is a security-relevant side effect.

中

SKILL.md:95

Ruby/shell backtick execution

If `MISSING`: re-run `stripe projects init --yes` — the skill is bundled with the Projects plugin an

The line tells the agent to rerun project initialization when the local skill is missing. That repeats a state-changing command and skill installation path.

中

SKILL.md:129

Ruby/shell backtick execution

| `PROVIDER_NOT_LINKED` | Provider requires OAuth linking | Run `stripe projects link <provider>` —

The recovery command can start provider OAuth linking and may open a browser. It links external accounts and should require explicit user confirmation.

审计者: codex 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/stripe-stripe-projects/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/stripe-stripe-projects/security.svg)](https://skillstore.io/skills/stripe-stripe-projects?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/stripe-stripe-projects?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/stripe-stripe-projects/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/stripe-stripe-projects.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

stripe. (2026). stripe-projects security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/stripe-stripe-projects/audits/5

BibTeX 引用

@techreport{stripe-stripe-stripe-projects-2026,
  author = {stripe},
  title = {stripe-projects security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/stripe-stripe-projects/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "stripe-projects security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "stripe"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/stripe-stripe-projects/audits/5"
identifiers:
  - type: other
    value: "skillstore:stripe-stripe-projects:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

添加应用基础设施

从 Stripe Projects 目录中预配数据库、缓存、身份验证提供商或托管服务。

检查项目设置

检查已初始化的项目状态，并列出环境变量名称，而不暴露密钥值。

构建 AI 服务栈

查找用于 LLM 访问、向量存储、对象存储、搜索和电子邮件发送的提供商。

试试这些提示

浏览可用服务

向我展示 Stripe Projects 目录，并为这个应用推荐数据库选项。

添加所需基础设施

使用 Stripe Projects 为此项目添加 Postgres 和 Redis。只显示环境变量名称。

预配 AI 栈

查找 LLM、向量数据库、对象存储和电子邮件发送的提供商。在预配前比较可用选项。

恢复项目设置

检查我的 Stripe Projects 状态，确认本地 CLI 技能可用，并诊断任何提供商链接错误。

最佳实践

在要求代理继续之前，先完成浏览器身份验证。
请求环境变量名称，而不是密钥值。
在预配付费服务之前，确认提供商选择和层级。

避免

不要要求代理打印 .env 密钥值。
不要在未确认成本、区域和层级的情况下预配服务。
不要手动编辑 .projects 或生成的环境文件。

常见问题

此技能会创建云资源吗？

是的。它可以运行 Stripe Projects CLI 流程，用于预配或连接受支持的第三方服务。

没有 Stripe CLI 也能工作吗？

不会。此技能需要先具备 Stripe CLI 和 Projects 插件，才能继续预配。

它能检索 API 凭据吗？

它可以帮助配置环境变量，但响应应只显示名称。密钥值应保持隐藏。

它能浏览服务目录吗？

可以。它可以在选择提供商之前搜索或浏览 Stripe Projects 目录。

需要身份验证时会发生什么？

CLI 可能会打开浏览器。用户必须先完成登录，代理才能继续。

它与 Claude、Codex 和 Claude Code 兼容吗？

是的。报告列出 Claude、Codex 和 Claude Code 为受支持的工具。

开发者详情

作者

stripe

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/stripe/ai/tree/main/skills/stripe-projects/

引用

f93e9bb0daca99badb6a7e574b97737155d57cb3

维护新鲜度

2026/7/18

使用量

3 次下载 · 2 次浏览

文件结构

📄 SKILL.md

stripe 的更多技能

查看全部

📦

upgrade-stripe

安全升级 Stripe 版本

Stripe 版本变更可能会破坏 API 响应、webhook 和 SDK 客户端。此技能为规划、测试和完成升级提供结构化指导。

编码与开发查看

📦

stripe-best-practices

构建更安全的 Stripe 集成

Stripe 集成涉及许多 API 选择、安全规则和已弃用模式。此技能会引导 Claude、Codex 和 Claude Code 采用当前的 Stripe 实现实践。

编码与开发查看

📦

financial-insights

Analyze Link Spending, Balances, and Shopping Insights

Financial questions require selecting relevant records and interpreting amounts, permissions, and data freshness. This skill guides agents through authorized Link queries and clear financial summaries.

数据与分析查看

📦

create-payment-credential

Create Approved Link Payment Credentials

Agent purchases require payment credentials that match each merchant checkout. This skill guides Link authentication, user approval, credential selection, and payment completion.

效率查看

查看全部

📦