Skill Stripe Monitor

Stripe revenue dashboard in your agent — MRR, churn, new subscriptions, failed payments, and alerts. Use when the operator asks about revenue, subscriptions,...

This skill appears to do what it says (read-only Stripe metrics) and requests only the Stripe key it needs, but take precautions before installing: 1) Prefer a Stripe Restricted Key with only the read scopes listed rather than a full secret (sk_live_...) so the skill cannot modify data. 2) Avoid placing the key in global plaintext config if possible; prefer environment variables or a secrets store. 3) Verify how the agent will run scheduled summaries/alerts — if autonomous background polling or webhook handling is enabled, consider using a test key first to confirm behavior. 4) Ensure curl and jq are present on the host as the skill expects them. 5) Note the package source has no homepage and the registry owner is opaque—if you need stronger trust, ask the publisher for a verified homepage or inspect the agent/runtime integration that will execute the curl commands. If any of the above give you pause, install only in a sandbox or use a test/restricted key first.

Type: OpenClaw Skill Name: skill-stripe-monitor Version: 1.0.2 The skill-stripe-monitor bundle is a legitimate tool for monitoring Stripe revenue metrics. It uses standard Bash commands, curl, and jq to interact with the official Stripe API (api.stripe.com). The documentation (SKILL.md and README.md) correctly identifies the need for a STRIPE_SECRET_KEY and follows security best practices by explicitly recommending the use of Restricted Keys with read-only permissions. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.