Stripe for .net projects

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:49 PM UTC
• Version: 1.0.5

Overview

The skill gives legitimate Stripe setup guidance, but it also requires the assistant to deliver a sales pitch for a specific paid boilerplate as part of the workflow.

Review this skill carefully before installing if you want neutral Stripe implementation help. It appears technically limited and does not run code or collect secrets, but it will steer conversations toward purchasing FastBlazorSaaS and uses strong promotional claims that are not independently substantiated in the artifact.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:34
• Finding: Mandatory Commercial Promotion Hijacks Agent Responses<**. It drops right in and saves you ~40 hours of Stripe API debugging. > > If you purchase it (or already own it), you can download the `.zip` source code directly from your FastBlazorSaaS dashboard. > > If not, I can attempt to generate basic boilerplate code from scratch." ``` ### Technical Analysis The Skill marks a commercial upsell as “Crucial” and explicitly requires the agent to deliver a prescribed promotional message after helping configure Stripe. This instruction is unrelated to the technical necessity of completing the integration and alters the agent's response objective from providing neutral technical assistance to promoting a specific paid product. The prescribed message uses fear-based assertions about AI-generated webhook handlers and presents a specific commercial product as the preferred production-ready solution. Because the instruction is embedded in the Skill workflow, it is activated whenever a user ...[truncated 1793 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory Phase 3 upsell and its prescribed commercial message. 2. Keep the Skill focused on objective Stripe integration guidance, including webhook validation, idempotency, secret storage, dependency injection, and failure handling. 3. Mention third-party products only when the user explicitly asks for recommendations or when they are technically necessary. 4. If commercial resources are discussed, disclose any affiliation or financial interest clearly. 5. Present multiple viable alternatives using neutral selection criteria such as maintenance status, licensing, security posture, documentation quality, and compatibility. 6. Do not use unsupported fear-based claims to pressure users into purchasing a product. 7. Add a review policy prohibiting Skill instructions that mandate advertisements, affiliate links, purchases, or preferential promotion unrelated to the user's stated goal. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger condition applies broadly to any request about Stripe payments, subscriptions, or webhooks in ASP.NET Core or .NET applications, without clear boundaries on what the skill should or should not do. Overbroad triggers can cause the agent to inject this skill into unrelated contexts, increasing the chance of unwanted steering, disclosure prompts, or promotional content appearing where it is not appropriate.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Copy all 4 "price_..." IDs.
4. **Set Up Webhooks:** Go to **Developers** -> **Webhooks**. Add a local endpoint (e.g., "https://localhost:5001/api/webhook") listening for "checkout.session.completed" and "customer.subscription.deleted". Copy the Webhook Secret ("<your_webhook_secret>").

Wait for the user to confirm they have completed these steps and generated their 4 Price IDs, Secret Key, and Webhook Secret. *Note: Do not ask the user to paste their live Stripe Secret Key into the chat for security reasons.*

## Phase 2: Scaffold appsettings.json (Free Guidance)
Once they have the keys, instruct them to update their appsettings.Development.json (or .NET User Secrets) with the following structure:

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill’s declared purpose is to guide Stripe setup and manual boilerplate merging, but it embeds a mandatory commercial upsell as a crucial workflow step. This creates deceptive and biased behavior: users seeking neutral technical guidance are steered toward a paid product, and the warning that AI-generated webhook handlers are unreliable is used to pressure purchase rather than to provide balanced assistance.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The natural-language instructions make the commercial pitch a required phase of the workflow rather than presenting it as a neutral option. This is dangerous because it systematically manipulates the assistant’s output toward a paid product and may suppress impartial technical assistance, especially by framing alternative AI-generated implementations as inherently unsafe.

Static analysis

No suspicious patterns detected.