Stripe CLI

Execute Stripe payments, refunds, subscriptions, customer and invoice management, webhook testing, and API calls, with optional ShapeScale clinic and subscri...

This skill mostly does what it says — it wraps the Stripe CLI and needs your Stripe secret key and the stripe binary. Before installing: 1) Confirm the registry metadata vs. package.json/SKILL.md mismatch — ensure STRIPE_SECRET_KEY and stripe binary are expected. 2) Review the GitHub repo referenced in SKILL.md/package.json to ensure it’s the intended upstream; the Linux install uses a GitHub .deb (normal for stripe-cli). 3) Only use test keys (sk_test_...) first; do not supply live secret keys until you inspect the code and are comfortable. 4) Note the skill may try to read 1Password (op read) as a fallback — if you use that, verify what it will fetch. 5) If you forward webhooks, ensure STRIPE_WEBHOOK_ENDPOINT points to a trusted endpoint (default is localhost). 6) Consider running in an isolated/non-production environment and inspect the scripts (they call stripe CLI and parse JSON with grep if jq is missing) before granting any secrets.

Type: OpenClaw Skill Name: stripe-cli Version: 1.0.0 The skill bundle is a straightforward wrapper for the Stripe CLI, providing payment processing, webhook testing, and API operations. It securely handles the `STRIPE_SECRET_KEY` by reading it from environment variables or 1Password. Installation instructions in `SKILL.md` and `package.json` use standard package managers (`brew`) or download official Stripe CLI binaries from GitHub releases (`wget`). The shell scripts (`scripts/stripe.sh`, `scripts/shapescale-ext.sh`) primarily execute the `stripe` CLI with user-provided arguments, without evidence of malicious execution (e.g., `eval` of untrusted input, arbitrary remote code execution) or data exfiltration. There are no prompt injection attempts against the AI agent in the markdown files, nor any signs of persistence mechanisms or obfuscation.