stripe-standard
Facilitates Stripe Standard account integration in Supabase with React/Flutter, covering various billing modalities for SaaS and e-commerce.
Install this skill
Security score
The stripe-standard skill was audited on Jun 7, 2026 and we found 20 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 135 | ```bash |
Template literal with variable interpolation in command context
| 389 | ```json |
Webhook reference - potential data exfiltration
| 27 | webhook endpoint** and zero Connect machinery. |
Webhook reference - potential data exfiltration
| 41 | but supported by the same `setup_webhook_endpoints(account_mode='connect')` |
Webhook reference - potential data exfiltration
| 80 | | Webhook endpoints | **1 solo** (vs 2 de Connect) | |
Webhook reference - potential data exfiltration
| 155 | echo " setup-as-code (verify_account_setup, setup_webhook_endpoints, etc.) no estarán" |
Webhook reference - potential data exfiltration
| 204 | or "always" in uc["modes"] # webhook handler, customer creation, paywall siempre van |
Webhook reference - potential data exfiltration
| 273 | | `stripe-webhook/index.ts` | always (1 solo endpoint, sin separar platform/connect) | |
Webhook reference - potential data exfiltration
| 370 | 2. Webhook handler sin verificación de firma |
Webhook reference - potential data exfiltration
| 371 | 3. Webhook handler sin idempotencia (`stripe_processed_events`) |
Webhook reference - potential data exfiltration
| 413 | | `STRIPE_WEBHOOK_SECRET` | salida de `stripe listen --forward-to ...` o el dashboard | |
Webhook reference - potential data exfiltration
| 416 | NO existe `STRIPE_WEBHOOK_SECRET_CONNECT` aquí — Standard solo tiene 1 endpoint. |
Webhook reference - potential data exfiltration
| 433 | STRIPE_WEBHOOK_SECRET: env.STRIPE_WEBHOOK_SECRET, |
Webhook reference - potential data exfiltration
| 454 | STRIPE_WEBHOOK_SECRET = <from `stripe listen` output> |
Webhook reference - potential data exfiltration
| 485 | 3. Ejecutar `stripe listen --forward-to <tu-edge-url>/stripe-webhook` en |
Webhook reference - potential data exfiltration
| 499 | | Webhook endpoints | 1 (platform-scope) | 2 (platform + connect) | |
Access to .env file
| 184 | - Secrets en .env (los pegas tú; la skill solo guía con el placeholder) |
Access to .env file
| 453 | STRIPE_SECRET_KEY = <from .env> |
Access to .env file
| 455 | STRIPE_PUBLISHABLE_KEY = <from .env> |
External URL reference
| 451 | https://supabase.com/dashboard/project/{project_ref}/settings/functions |