Stripe Full Read Access

Access Stripe directly with a Stripe secret or restricted API key for broad read-only platform queries, especially Connect accounts, application fees, balanc...

Security Scan

The skill's stated purpose (read-only Stripe access) matches its runtime instructions, but it omits declaring the sensitive credential it expects and hardcodes a user-specific key path—those inconsistencies increase risk and merit caution.

Purpose & Capability

The skill claims broad read-only Stripe access and the SKILL.md contains concrete curl/python examples that only call read endpoints (accounts, balance, charges, etc.). The requested operations are consistent with the description.

Instruction Scope

The instructions explicitly instruct the agent to read a local file at /home/clawd/.config/stripe/api_key and to export it as STRIPE_API_KEY. The skill does not declare this file path or credential anywhere in the registry metadata. Hardcoding a specific home-path for a user named 'clawd' is surprising and may not apply to other users; it also means the agent will attempt to read a sensitive local file when invoked.

Install Mechanism

This is an instruction-only skill with no install spec or code files, so there is no software downloaded or executed beyond the commands shown in SKILL.md (low install risk).

Credentials

The skill requires a Stripe secret to function, but the registry metadata lists no required env vars or primary credential. The SKILL.md instructs using STRIPE_API_KEY and a specific local file path and even recommends a platform-level key for Connect reporting—platform keys are highly privileged. The lack of declared credential in metadata is an inconsistency and raises the chance of accidental exposure or misuse of a full-access key.

Persistence & Privilege

always is false and there is no installation that modifies agent-wide settings. The skill does instruct reading a local secret at runtime, but it does not request persistent presence or elevated platform privileges.

What to consider before installing

This skill appears to do what it says (read Stripe data), but it has some red flags you should address before installing or running it: - The SKILL.md expects a Stripe API key at /home/clawd/.config/stripe/api_key and uses STRIPE_API_KEY, but the skill metadata does not declare any required credential or primaryEnv. Confirm where your agent will look for keys and whether that hardcoded path is appropriate for your environment. - The SKILL.md recommends using a platform-level key for Connect reporting. Platform keys are highly sensitive—prefer creating and using a restricted, read-only key scoped only to the endpoints you need. - Because the skill instructs the agent to read a local file, ensure the agent process has explicit permission to access that path and that no unintended keys reside there. If you run agents in multi-tenant or cloud environments, do not place secrets in predictable filesystem locations. - Consider updating the skill or configuration to: declare the expected credential in metadata (primaryEnv or requires.env), make the key path configurable (not hardcoded to /home/clawd/...), and document the minimal OAuth/Restricted key scopes required. If you cannot confirm these items, treat the skill as higher-risk and avoid granting it access to any production/privileged Stripe keys.

Use direct Stripe API access with a locally stored Stripe API key.

Requirements

• Stripe API key stored locally, outside git
• Prefer a platform-level key when querying Connect accounts or application fees
• Use this skill for read-oriented Stripe analysis and reporting

Local key path used in this workspace:

• /home/clawd/.config/stripe/api_key

Authentication

Authorization: Bearer $STRIPE_API_KEY

Example shell setup:

export STRIPE_API_KEY="$(cat /home/clawd/.config/stripe/api_key)"

Base URL

https://api.stripe.com/v1/

Quick checks

Get platform account

curl -sS https://api.stripe.com/v1/account \
  -H "Authorization: Bearer $(cat /home/clawd/.config/stripe/api_key)"

List connected accounts

curl -sS 'https://api.stripe.com/v1/accounts?limit=10' \
  -H "Authorization: Bearer $(cat /home/clawd/.config/stripe/api_key)"

Get balance

curl -sS https://api.stripe.com/v1/balance \
  -H "Authorization: Bearer $(cat /home/clawd/.config/stripe/api_key)"

Common endpoints

• Account: /v1/account
• Balance: /v1/balance
• Connected accounts: /v1/accounts
• Charges: /v1/charges
• Customers: /v1/customers
• Payment intents: /v1/payment_intents
• Payouts: /v1/payouts
• Invoices: /v1/invoices
• Subscriptions: /v1/subscriptions
• Balance transactions: /v1/balance_transactions
• Application fees: /v1/application_fees
• Transfers: /v1/transfers

Useful patterns

Count connected accounts

Use pagination until has_more is false.

python3 - <<'PY'
import json, urllib.request, urllib.parse
from pathlib import Path
key = Path('/home/clawd/.config/stripe/api_key').read_text().strip()
count = 0
starting_after = None
while True:
    params = {'limit': 100}
    if starting_after:
        params['starting_after'] = starting_after
    req = urllib.request.Request('https://api.stripe.com/v1/accounts?' + urllib.parse.urlencode(params))
    req.add_header('Authorization', f'Bearer {key}')
    with urllib.request.urlopen(req, timeout=60) as r:
        data = json.load(r)
    items = data.get('data', [])
    count += len(items)
    if not data.get('has_more') or not items:
        print(count)
        break
    starting_after = items[-1]['id']
PY

List recent application fees

curl -sS 'https://api.stripe.com/v1/application_fees?limit=10' \
  -H "Authorization: Bearer $(cat /home/clawd/.config/stripe/api_key)"

List recent payouts

curl -sS 'https://api.stripe.com/v1/payouts?limit=10' \
  -H "Authorization: Bearer $(cat /home/clawd/.config/stripe/api_key)"

List recent charges

curl -sS 'https://api.stripe.com/v1/charges?limit=10' \
  -H "Authorization: Bearer $(cat /home/clawd/.config/stripe/api_key)"

Connect notes

• Use direct Stripe auth for platform-level Connect reporting.
• This setup can access /v1/accounts, which confirms platform visibility.
• For fee-revenue questions, inspect application_fees, balance_transactions, and transfers together.
• Some money fields are integer minor units. For GBP, divide by 100.
• Be explicit about whether figures are gross charges, application fees, net balance movement, pending, or available.

Safety

• Never commit Stripe API keys.
• Never write Stripe API keys into memory files.
• Prefer read-only analysis unless the user explicitly asks for writes.
• Be careful with endpoints that can create refunds, payouts, transfers, or account changes.