stripe-integration-expert

Stripe Integration Expert

This skill looks like a useful Stripe integration guide, but the SKILL.md expects multiple sensitive environment variables (Stripe secret key, price IDs, webhook signing secret, app URL) and access to your app's DB/auth helpers while the registry metadata lists none. Before installing or invoking it: (1) ask the publisher to update the metadata to declare required env vars and the primary credential (STRIPE_SECRET_KEY) so you know what will be requested; (2) never paste your Stripe secret key or webhook signing secret into an unfamiliar skill — treat them like passwords; (3) prefer running this guide locally and copying code manually rather than giving the skill live access to your environment or secrets; (4) if you must provide credentials for testing, use a throwaway/test Stripe account and isolated environment; (5) inspect any produced code for places that might read other files or send data to unexpected endpoints; and (6) if you want to allow autonomous invocation, only do so after the author declares required env vars and you are confident about how secrets will be used.

Type: OpenClaw Skill Name: stripe-integration-expert Version: 1.0.0 The skill bundle provides legitimate, high-quality code examples and instructions for implementing Stripe payments and subscriptions. It includes security best practices like webhook signature verification and idempotency checks in SKILL.md, and shows no signs of malicious intent, data exfiltration, or prompt injection. All logic is strictly related to the stated purpose of Stripe integration.