stripe-best-practices

SAFE max severity MEDIUMSkillSpector Safe 0 registry stripe last scanned 1 scan

Verdict safe, but 4 findings (1 medium, 3 low), mainly policy violation, prompt injection, unauthorized tool use. Most recent scan 2026-02-08.

This Stripe best practices skill presents MEDIUM security risk primarily due to transitive trust abuse through external documentation dependencies. The skill instructs the agent to follow and prioritize content from external Stripe documentation URLs without validation, creating a potential indirect prompt injection vector if those sources were compromised. Additionally, the skill references a missing file ('another.py') which indicates incomplete packaging and could be exploited in social engineering scenarios. The skill contains no executable scripts, which limits the attack surface, but the reliance on external content and missing metadata reduce overall security posture. The skill would benefit from bundling critical documentation internally, removing broken file references, and completing manifest metadata.

Scanner's overall assessment (LLM analyzer)
Findings4
Critical0
High0
Medium1
Low3
Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictSafe 0
Score0 / 100
Issues0
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Best practices for building a Stripe integrations

Package
1 file, 5.2 KB
SKILL.md
595 words
Code
None. Instructions only.

Findings

MEDIUM Transitive Trust Abuse - External Documentation Dependencies Prompt Injectionllm

The skill instructs the agent to follow and prioritize external Stripe documentation URLs (docs.stripe.com) without any validation or security controls. This creates a transitive trust relationship where the agent will follow instructions from external sources that could be compromised or manipulated. If Stripe's documentation were compromised or if an attacker could perform DNS/routing attacks, malicious instructions could be injected into the agent's workflow.

SKILL.md

When designing an integration, always prefer the documentation in [Stripe's Integration Options doc](https://docs.stripe.com/payments/payment-methods/integration-options.md)
The [API Tour](https://docs.stripe.com/payments-api/tour.md)
Use the [Go Live Checklist](https://docs.stripe.com/get-started/checklist/go-live.md)
Remediation: 1. Bundle critical Stripe documentation within the skill package as internal reference files instead of relying on external URLs. 2. Add explicit warnings that external documentation should be verified before following. 3. Implement content validation if external sources must be used. 4. Consider caching and versioning external documentation to prevent real-time manipulation.
LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)
LOW Missing Referenced File - Broken Tool Chain Unauthorized Tool Usellm

The skill references 'another.py' in its instructions but this file is not found in the skill package. This creates a broken tool chain where the agent may attempt to access or execute a non-existent file, potentially leading to unexpected behavior or errors. While not directly exploitable, this indicates incomplete skill packaging and could be leveraged in social engineering attacks where an attacker provides a malicious 'another.py' file.

Files referenced in instructions: another.py
**Referenced File: another.py** (not found)
Remediation: 1. Remove the reference to 'another.py' if it's not needed. 2. Include the missing 'another.py' file in the skill package if it's required. 3. Add validation to check for required files before skill execution. 4. Document all file dependencies clearly in the manifest.
LOW Incomplete Manifest Metadata Social Engineeringllm

The skill manifest is missing several optional but recommended fields: 'license', 'compatibility', and 'allowed-tools'. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage constraints and compatibility requirements. This makes it harder for users to assess the skill's trustworthiness and appropriate usage context.

SKILL.md

- license: Not specified
- compatibility: Not specified
- allowed-tools: Not specified
Remediation: 1. Add 'license' field to specify the skill's licensing terms (e.g., MIT, Apache-2.0). 2. Add 'compatibility' field to document which agent environments this skill works with. 3. Add 'allowed-tools' field to explicitly declare which agent tools this skill requires (e.g., [Read] for documentation access). This improves transparency and helps users make informed decisions about skill usage.

What is in the package

FileKindSize
SKILL.mddoc5.2 KB

External hosts referenced

docs.stripe.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22 at commit 57ef25cdb9a1. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills