stripe-handler
Facilitates custom Stripe payment processing and webhook handling for non-standard transactions, enhancing e-commerce capabilities.
Install this skill
Security score
The stripe-handler skill was audited on Feb 28, 2026 and we found 17 security issues across 3 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 39 | - Success: `${process.env.NEXT_PUBLIC_APP_URL}/app/subscribe/success?session_id={CHECKOUT_SESSION_ID}` |
Template literal with variable interpolation in command context
| 40 | - Error: `${process.env.NEXT_PUBLIC_APP_URL}/app/subscribe/error` |
Webhook reference - potential data exfiltration
| 3 | description: Handle Stripe payments, custom checkouts, and webhook fulfillment outside of standard plans/credits. |
Webhook reference - potential data exfiltration
| 15 | - Customizing `src/app/api/webhooks/stripe/route.ts` for non-standard events. |
Webhook reference - potential data exfiltration
| 16 | - Offloading heavy webhook processing to background tasks (via Inngest). |
Webhook reference - potential data exfiltration
| 30 | - **Metadata**: **CRITICAL**. Always attach `metadata` to the session to identify the purchase type in the webhook. |
Webhook reference - potential data exfiltration
| 42 | ### 3. Handle Webhook Fulfillment |
Webhook reference - potential data exfiltration
| 43 | All Stripe events go to `src/app/api/webhooks/stripe/route.ts`. |
Webhook reference - potential data exfiltration
| 44 | - **File**: `src/app/api/webhooks/stripe/route.ts` |
Webhook reference - potential data exfiltration
| 57 | - In the webhook, just dispatch the event: |
Webhook reference - potential data exfiltration
| 65 | - Ensure the fulfillment is idempotent (handle duplicate webhook events gracefully). |
Webhook reference - potential data exfiltration
| 72 | - **Idempotency**: Webhooks can fire multiple times. Ensure your logic checks if the order is already fulfilled. |
Webhook reference - potential data exfiltration
| 74 | - **Timeouts**: Stripe webhooks must respond quickly. Use Inngest for anything taking > 2 seconds. |
Webhook reference - potential data exfiltration
| 75 | - **Testing**: Use `stripe listen` to test webhooks locally. |
Webhook reference - potential data exfiltration
| 78 | See `reference.md` for code snippets on creating sessions, handling webhooks, and using Inngest. |
Access to .env file
| 39 | - Success: `${process.env.NEXT_PUBLIC_APP_URL}/app/subscribe/success?session_id={CHECKOUT_SESSION_ID}` |
Access to .env file
| 40 | - Error: `${process.env.NEXT_PUBLIC_APP_URL}/app/subscribe/error` |