Stripe CLI

Execute Stripe payments, refunds, subscriptions, customer and invoice management, webhook testing, and API calls, with optional ShapeScale clinic and subscri...

Security Scan

This is a coherent Stripe-CLI wrapper (scripts call the stripe binary and require a Stripe secret key), but there are metadata/instruction inconsistencies and a few behaviors you should verify before installing (secret access patterns, optional 1Password lookup, and download/clone instructions).

Purpose & Capability

The scripts and SKILL.md implement a Stripe CLI wrapper and optional ShapeScale extensions and legitimately need the stripe binary and a STRIPE_SECRET_KEY. However, the registry summary at the top says 'Required env vars: none' and 'Required binaries: none', while package.json and SKILL.md declare requires.bins=['stripe'] and env STRIPE_SECRET_KEY. That metadata mismatch is incoherent and should be corrected/confirmed before trusting the skill.

Instruction Scope

Runtime instructions and scripts primarily call the stripe CLI and read an optional shapescale-presets.json; they do not attempt to read unrelated system files. Two things to note: (1) the scripts will try to read secrets from 1Password (op read) as a fallback, which accesses an external secret store; (2) webhook listen forwards Stripe webhook payloads to STRIPE_WEBHOOK_ENDPOINT (default http://localhost:4242) — if you change that variable, webhooks could be forwarded to any endpoint. The ShapeScale JSON parsing falls back to brittle grep-based parsing when jq is absent (functional but error-prone).

Install Mechanism

The registry listing claims 'no install spec' but package.json contains moltbot.install entries (brew formula for macOS and a GitHub release .deb download for Linux). The Linux download is a GitHub releases .deb (expected for Stripe CLI) rather than an unknown host, so the install sources appear reasonable — but the mismatch between the registry metadata and the repository/package.json should be clarified.

Credentials

The skill legitimately requires STRIPE_SECRET_KEY and mentions STRIPE_WEBHOOK_ENDPOINT and SHAPESCALE_PRESETS_PATH. Those are proportional to the stated purpose. However, the registry metadata at the top lists no required env vars while SKILL.md and package.json declare STRIPE_SECRET_KEY required — this discrepancy is suspicious. Also the scripts optionally attempt to read secrets from 1Password (op read), which accesses another credentials store and may be unexpected for some users.

Persistence & Privilege

The skill is instruction-only (no install executed by the platform) and has always: false. It does not request persistent inclusion or attempt to modify other skills or system-wide settings. There is no evidence it writes persistent credentials or enables itself beyond normal skill installation.

What to consider before installing

This skill mostly does what it says — it wraps the Stripe CLI and needs your Stripe secret key and the stripe binary. Before installing: 1) Confirm the registry metadata vs. package.json/SKILL.md mismatch — ensure STRIPE_SECRET_KEY and stripe binary are expected. 2) Review the GitHub repo referenced in SKILL.md/package.json to ensure it’s the intended upstream; the Linux install uses a GitHub .deb (normal for stripe-cli). 3) Only use test keys (sk_test_...) first; do not supply live secret keys until you inspect the code and are comfortable. 4) Note the skill may try to read 1Password (op read) as a fallback — if you use that, verify what it will fetch. 5) If you forward webhooks, ensure STRIPE_WEBHOOK_ENDPOINT points to a trusted endpoint (default is localhost). 6) Consider running in an isolated/non-production environment and inspect the scripts (they call stripe CLI and parse JSON with grep if jq is missing) before granting any secrets.

Stripe CLI Skill 🧾

A universal Moltbot skill wrapping Stripe CLI for payment processing, webhook testing, and API operations. Includes optional ShapeScale-specific extensions for clinic management.

What It Does

• Process payments, refunds, and subscriptions
• Manage customers and invoices
• Test webhooks locally
• Execute generic API calls to Stripe
• ShapeScale extensions (optional): Clinic presets, subscription plans, order integration

Installation

1. Install Stripe CLI

macOS:

brew install stripe/stripe-cli/stripe

Linux:

# Download from https://github.com/stripe/stripe-cli/releases
wget https://github.com/stripe/stripe-cli/releases/download/v1.34.0/stripe_1.34.0_linux_amd64.deb
sudo dpkg -i stripe_1.34.0_linux_amd64.deb

Authenticate:

stripe login

2. Set Environment Variable

export STRIPE_SECRET_KEY=sk_test_your_key_here

Or use 1Password:

op read "op://Stripe/Secret Key" --vault Personal

3. Clone to Skills

cd ~/.moltbot/skills/
git clone https://github.com/mkessler/stripe-cli-moltbot-skill.git stripe

Usage

Universal Commands

Invocation	Description
Create a test customer for $50	Creates customer + $50 payment intent
List my recent payments	Lists last 10 payment intents
Check payment status for pi_xxx	Retrieves payment intent details
Refund payment pi_xxx	Refunds the full amount
Trigger payment_intent.succeeded webhook	Simulates webhook event
Listen for webhooks for 30s	Forwards webhooks to localhost
Get customer details for cus_xxx	Retrieves customer record

ShapeScale Extensions (Optional)

Requires config/shapescale-presets.json:

Invocation	Description
Create clinic deposit for PracticeXYZ	Creates customer + deposit template
Create monthly subscription for clinic	Creates recurring payment from presets
Generate invoice for order #1234	Creates invoice from template
Check order status 1234	Cross-references with shapescale-db

Configuration

Universal

No config required. Uses STRIPE_SECRET_KEY environment variable.

ShapeScale Presets (Optional)

Create config/shapescale-presets.json:

{
  "clinic_templates": {
    "standard": { "deposit": 5000, "terms": "net30" },
    "premium": { "deposit": 10000, "terms": "net30" }
  },
  "subscription_plans": {
    "monthly": { "amount": 39900, "interval": "month" },
    "annual": { "amount": 399000, "interval": "year" }
  },
  "tax_rate": 0.0875,
  "default_currency": "usd"
}

Environment Variables

Variable	Required	Description
STRIPE_SECRET_KEY	Yes	Stripe secret key (test or live)
STRIPE_WEBHOOK_ENDPOINT	No	Webhook forwarding URL (default: http://localhost:4242)
SHAPESCALE_PRESETS_PATH	No	Path to shapescale-presets.json

File Structure

stripe/
├── SKILL.md                    # This file
├── scripts/
│   ├── stripe.sh               # Universal CLI wrapper
│   └── shapescale-ext.sh       # ShapeScale extensions (optional)
├── config/
│   └── shapescale-presets.json # Clinic/subscription templates
├── patterns/
│   └── examples.md             # Usage examples
└── README.md                   # Installation guide (auto-generated)

State

Stateless — Pure function of inputs. All state lives in Stripe.

Integration with Other Skills

Skill	Integration
shapescale-crm	Link Stripe customer ID to CRM records
shapescale-sales	Orders → Payment intent creation
campaign-orchestrator	Failed payment → Follow-up campaign
shapescale-db	Match payments to database orders

Publishing

This skill is published to ClawdHub and available at: https://github.com/mkessler/stripe-cli-moltbot-skill

License

MIT License - see LICENSE file for details.