Native Stripe

Query and manage Stripe data via the Stripe API. Use when you need to list charges, customers, invoices, subscriptions, payment intents, refunds, products, o...

This skill appears to do what it claims: run a bundled Python script that calls Stripe directly. Before installing, consider: 1) Use a restricted or test API key (sk_test_...) rather than your live key when possible; Stripe supports restricted keys with limited permissions—prefer least privilege. 2) Treat STRIPE_SECRET_KEY as highly sensitive: don’t paste it into untrusted places and rotate it if you suspect exposure. 3) Review the bundled script yourself (it’s small and uses only the Python stdlib over HTTPS). 4) Run the skill in a trusted environment (not a shared or public machine). 5) If you need reduced risk, avoid granting live keys and instead create a read-only or restricted key for the operations you need.

Type: OpenClaw Skill Name: native-stripe Version: 1.0.1 The OpenClaw skill 'native-stripe' is designed to interact with the Stripe API directly. The `SKILL.md` and `README.md` provide clear, non-malicious instructions for the AI agent and user, without any prompt injection attempts. The `stripe_query.py` script uses standard Python libraries (`urllib.request`, `json`, `os`) to make authenticated requests to `https://api.stripe.com/v1`. It correctly retrieves the `STRIPE_SECRET_KEY` from environment variables and uses it for API authentication. All network communication is confined to the official Stripe API endpoint, and there is no evidence of data exfiltration, unauthorized execution, persistence mechanisms, or other malicious intent. Input parameters are handled via `argparse`, limiting the scope for arbitrary command injection.