技能 stripe-webhook-review
📦
stripe-webhook-review
內容修訂 r1 安全 ⚙️ 外部命令
Review Stripe Webhook Security and Retry Safety
Stripe webhook mistakes can allow forged events, duplicate side effects, or lost payment updates. This skill guides read-only Next.js reviews with severity labels and concrete fixes.
支援: Claude Codex Code(CC)
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "stripe-webhook-review" from https://skillstore.io/skills/edtrackai-stripe-webhook-review.md and its manifest at https://skillstore.io/api/skills/edtrackai-stripe-webhook-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「stripe-webhook-review」。 Review a handler that trusts parsed event data without signature verification.
預期結果:
- Critical, S1: The handler trusts events without Stripe signature verification.
- Critical, S2: Parsing JSON before verification does not preserve the raw signed body.
- Suggested fix: Verify the raw body, signature, and endpoint secret before processing. Return 400 when verification fails.
正在使用「stripe-webhook-review」。 Review a handler that returns 200 for every previously recorded event, including failed pending attempts.
預期結果:
- Medium, S6: Status-blind deduplication prevents failed pending events from retrying.
- Suggested fix: Track pending and completed states. Protect reprocessing with idempotent writes or an atomic lease and deduplicate side effects.
- Verification gap: Queue worker behavior cannot be assessed when its implementation is unavailable.
安全審計
安全v1 • 2026/10/14 開啟版本化報告
All 14 static findings are false positives: Markdown examples, a read-only project search, and webhook terminology were misclassified as execution or reconnaissance. The skill provides defensive review guidance and explicitly limits changes to user-requested fixes. No evidence found of prompt injection, credential exfiltration, destructive actions, or unauthorized system reconnaissance.
1
已掃描檔案
48
分析行數
0
複核項目
0
已忽略的誤報
風險因素
最近一次完成的靜態與語意稽核未偵測到已確認的安全發現。這並不能證明該 Skill 沒有副作用。
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/edtrackai-stripe-webhook-review/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/edtrackai-stripe-webhook-review?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/edtrackai-stripe-webhook-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/edtrackai-stripe-webhook-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/edtrackai-stripe-webhook-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
edtrackai. (2026). stripe-webhook-review security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/edtrackai-stripe-webhook-review/audits/1BibTeX 引用
@techreport{edtrackai-edtrackai-stripe-webhook-review-2026,
author = {edtrackai},
title = {stripe-webhook-review security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/edtrackai-stripe-webhook-review/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "stripe-webhook-review security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "edtrackai"
date-released: "2026-10-14"
url: "https://skillstore.io/skills/edtrackai-stripe-webhook-review/audits/1"
identifiers:
- type: other
value: "skillstore:edtrackai-stripe-webhook-review:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Review payment handlers before launch
Check signature verification, raw-body handling, and event tracking before deploying a Next.js payment integration.
Investigate duplicate processing
Review pending events, leases, and side-effect deduplication when retries appear to repeat emails or credit grants.
Assess subscription entitlement changes
Review subscription item selection and checkout identity validation during billing changes or a multi-item subscription migration.
試試這些提示
Basic webhook review
Review my Next.js Stripe webhook handlers without editing files. List findings by severity, include file references, and explain anything you cannot verify.
Verify event authenticity
Review signature verification and raw-body handling in my Stripe webhook routes. Check that unverified events cannot reach processing and verification failures return 400.
Audit retry behavior
Trace event.id tracking through handlers and helpers. Review pending/completed transitions, failed attempts, concurrent deliveries, leases, and side-effect deduplication. Do not edit files.
Review the complete billing workflow
Review webhook handlers, claim/complete helpers, and available queue workers. Check item-specific entitlements and checkout identity validation. Distinguish verified findings from unavailable evidence.
最佳實務
- Provide webhook handlers and their claim, completion, synchronization, and queue helpers for a connected review.
- Include the Stripe API version and entitlement mapping when reviewing multi-item subscriptions.
- Treat findings as review prompts and verify proposed changes with signature, retry, and concurrent-delivery tests.
避免
- Treating a heuristic finding as proof without inspecting the referenced handler and helpers.
- Reprocessing pending events with non-idempotent side effects and no lease or deduplication key.
- Assuming the first subscription item always controls entitlements in a multi-item subscription.
常見問題
Which frameworks does this skill target?
It targets Next.js Stripe webhook handlers in App Router routes and Pages Router API handlers, including their processing helpers.
Does the skill change my code?
No. It performs a read-only review unless you subsequently request fixes.
Does it test live Stripe deliveries?
No. It reviews available source code and reports checks that it cannot verify.
What does the review report include?
It includes handlers reviewed, severity counts, check identifiers, file-and-line references, suggested fixes, and verification gaps.
Are all pending-event retries unsafe?
No. The skill checks for non-idempotent work without a lease or deduplication key before flagging pending-event reprocessing.
Can it guarantee payment security?
No. Its checks are heuristics and do not replace broader security review, integration tests, or concurrency testing.