Stripe Cli

• Risk level: Low
• Analyzed: Feb 21, 2026, 9:37 AM
• Findings: 0
• Version: 0.1.0

Overview

The skill's files, runtime instructions, and bundled scripts are consistent with a Stripe CLI helper for local/sandbox use and do not request disproportionate privileges or perform suspicious actions.

This skill appears to be a straightforward helper for the Stripe CLI. Before installing or running it: (1) ensure you have the official stripe CLI installed from Stripe; (2) use test/sandbox API keys (sk_test_...) — never provide live keys unless you intentionally perform live-mode work and understand the blast radius; (3) confirm webhook forwarding targets are localhost/127.0.0.1 to avoid sending webhook payloads to an external host; (4) inspect the two bundled scripts (stripe-dev-listen.sh and stripe-sanitize.sh) yourself before executing; (5) sanitize logs with the included sanitize script before sharing; and (6) if you want to prevent autonomous agent invocation, disable model invocation for this skill in your agent settings. Overall the skill is coherent and low-risk for its stated use, but treat API keys and webhook data as sensitive and follow the provided guardrails.