Stripe Cli

• Outcome: Pass
• Latest audit: May 28, 2026 at 5:44 AM UTC
• Version:
  0.1.0

Overview

This is a coherent Stripe CLI helper with expected webhook, test-event, and log-sanitizing behavior, though users should treat Stripe secrets and forwarded webhook data as sensitive.

Install only if you intend to use Stripe CLI workflows. Use test or sandbox keys by default, check the active Stripe account before mutations, avoid forwarding webhooks to non-localhost URLs unless you explicitly trust the destination, and keep sk_*, rk_*, and whsec_* values out of commits, logs, and chats.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file includes a step to copy a Stripe webhook signing secret into the local environment. Although the workflow is legitimate, the description does not explicitly warn that the value is sensitive and should not be committed, shared, or reused outside a safe local context.

VirusTotal

62/62 vendors flagged this skill as clean.