stripe-best-practices 96/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUM"Never tell the user" non-disclosure imperative in the skillSS-SKILL-INJECT-IMPERATIVE-01 · Prompt injection · plugins/stripe-skills/skills/stripe-best-practices/references/security.md

MEDIUM — it fires on intent; whether the agent honors the non-disclosure imperative depends on the host model.

Why it matters

A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.

The exact value spotted

excerptplugins/stripe-skills/skills/stripe-best-practices/references/security.md· markdown

22Always advise the user on best practices for handling secrets such as secret API keys or res

… (17 chars elided on L22)

24- Never share secret keys with third parties. If the user needs to share a key with a third

… (108 chars elided on L24)

25- Rotate Stripe API keys when personnel with access to those keys depart.

26- Read [best practices for managing secret API keys](https://docs.stripe.com/keys-best-pract

… (9 chars elided on L26)

Occurrences

1 occurrence · at L23

How to fix

Remove the non-disclosure imperative, or rescope it so it limits output format, not honesty to the user.

Delete any "never reveal / never tell the user" line aimed at the model's own behavior.
Keep legitimate confidentiality rules about external data (e.g. "do not echo API keys"), which are user-protective, not user-deceiving.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-IMPERATIVE-01sha25682ccbf2b208f5d32…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/stripe-skills/skills/stripe-best-practices/SKILL.md · 1 file

plugins/stripe-skills/skills/stripe-best-practices/SKILL.md2.6 KB · Markdown

name: stripe-best-practices

description: >-

Guides Stripe integration decisions — API selection (Checkout Sessions vs

PaymentIntents), Connect platform setup (Accounts v2, controller properties),

billing/subscriptions, Treasury financial accounts, integration surfaces

(Checkout, Payment Element), migrating from deprecated Stripe APIs, and

security best practices (API key management, restricted keys, webhooks,

OAuth). Use when building, modifying, or reviewing any Stripe integration —

including accepting payments, building marketplaces, integrating Stripe,

processing payments, setting up subscriptions, creating connected accounts, or

implementing secure key handling.

license: MIT

Latest Stripe API version: 2026-03-25.dahlia. Always use the latest API version and SDK unless the user specifies otherwise.

Integration routing

Building…	Recommended API	Details
One-time payments	Checkout Sessions	<references/payments.md>
Custom payment form with embedded UI	Checkout Sessions + Payment Element	<references/payments.md>
Saving a payment method for later	Setup Intents	<references/payments.md>
Connect platform or marketplace	Accounts v2 (`/v2/core/accounts`)	<references/connect.md>
Subscriptions or recurring billing	Billing APIs + Checkout Sessions	<references/billing.md>
Embedded financial accounts / banking	v2 Financial Accounts	<references/treasury.md>
Security (key management, RAKs, webhooks, OAuth, 2FA, Connect liability)	See security reference	<references/security.md>

Read the relevant reference file before answering any integration question or writing code.

Key documentation

When the user’s request does not clearly fit a single domain above, consult:

Integration Options — Start here when designing any integration.
API Tour — Overview of Stripe’s API surface.
Go Live Checklist — Review before launching.

stripe-best-practices— agent skill

Is stripe-best-practices safe to install?

Integration routing

Key documentation

Audit the pieces. Scan the whole. Decide.