stripe-integration-v6
Facilitates robust, PCI-compliant Stripe payment processing integration for seamless checkout, subscriptions, and refunds.
Install this skill
Security score
The stripe-integration-v6 skill was audited on May 14, 2026 and we found 29 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 3 | description: "Stripe Integration workflow skill. Use this skill when the user needs Master Stripe payment processing integration for robust, PCI-compliant payment flows including checkout, subscriptio |
Webhook reference - potential data exfiltration
| 59 | # Stripe Integration Master Stripe payment processing integration for robust, PCI-compliant payment flows including checkout, subscriptions, webhooks, and refunds. |
Webhook reference - potential data exfiltration
| 61 | Imported source sections that did not map cleanly to the public headings are still preserved below or in the support files. Notable imported sections: Core Concepts, Payment Implementation Patterns, W |
Webhook reference - potential data exfiltration
| 125 | ### 2. Webhooks |
Webhook reference - potential data exfiltration
| 219 | - Always Use Webhooks: Don't rely solely on client-side confirmation |
Webhook reference - potential data exfiltration
| 220 | - Idempotency: Handle webhook events idempotently |
Webhook reference - potential data exfiltration
| 231 | 1. **Always Use Webhooks**: Don't rely solely on client-side confirmation |
Webhook reference - potential data exfiltration
| 232 | 2. **Idempotency**: Handle webhook events idempotently |
Webhook reference - potential data exfiltration
| 285 | - **references/webhook-handling.md**: Webhook security and processing |
Webhook reference - potential data exfiltration
| 290 | - **assets/webhook-handler.py**: Complete webhook processor |
Webhook reference - potential data exfiltration
| 405 | #### Imported: Webhook Handling |
Webhook reference - potential data exfiltration
| 407 | ### Secure Webhook Endpoint |
Webhook reference - potential data exfiltration
| 416 | @app.route('/webhook', methods=['POST']) |
Webhook reference - potential data exfiltration
| 417 | def webhook(): |
Webhook reference - potential data exfiltration
| 422 | event = stripe.Webhook.construct_event( |
Webhook reference - potential data exfiltration
| 471 | ### Webhook Best Practices |
Webhook reference - potential data exfiltration
| 476 | def verify_webhook_signature(payload, signature, secret): |
Webhook reference - potential data exfiltration
| 477 | """Manually verify webhook signature.""" |
Webhook reference - potential data exfiltration
| 486 | def handle_webhook_idempotently(event_id, handler): |
Webhook reference - potential data exfiltration
| 487 | """Ensure webhook is processed exactly once.""" |
Webhook reference - potential data exfiltration
| 498 | # Stripe will retry failed webhooks |
Webhook reference - potential data exfiltration
| 615 | - **Not Verifying Webhooks**: Always verify webhook signatures |
Webhook reference - potential data exfiltration
| 616 | - **Missing Webhook Events**: Handle all relevant webhook events |
External URL reference
| 207 | success_url='https://yourdomain.com/success?session_id={CHECKOUT_SESSION_ID}', |
External URL reference
| 208 | cancel_url='https://yourdomain.com/cancel', |
External URL reference
| 307 | 'images': ['https://example.com/product.jpg'], |
External URL reference
| 314 | success_url='https://yourdomain.com/success?session_id={CHECKOUT_SESSION_ID}', |
External URL reference
| 315 | cancel_url='https://yourdomain.com/cancel', |
External URL reference
| 400 | return_url='https://yourdomain.com/account', |