stripe-switch-account
Facilitates safe rotation of Stripe accounts in SpecBox projects, ensuring seamless transitions without affecting existing data.
Install this skill
Security score
The stripe-switch-account skill was audited on Jun 7, 2026 and we found 17 security issues across 3 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 28 | which account the platform's Edge Functions talk to, where the webhooks |
Webhook reference - potential data exfiltration
| 83 | - ¿Hay `supabase/functions/stripe-webhook` con un solo endpoint? → `account_mode='standard'`. |
Webhook reference - potential data exfiltration
| 84 | - ¿Hay 2 webhooks (platform + connect) o referencias a `application_fee_percent`? → `account_mode='connect'`. |
Webhook reference - potential data exfiltration
| 121 | (2) archive_products_only — archivar los products SpecBox, dejar webhooks |
Webhook reference - potential data exfiltration
| 122 | (3) deactivate_webhooks_only — deshabilitar webhooks, dejar products |
Webhook reference - potential data exfiltration
| 143 | platform_url: "https://{ref}.supabase.co/functions/v1/stripe-webhook", |
Webhook reference - potential data exfiltration
| 156 | Webhook endpoints: 1 SpecBox-managed |
Webhook reference - potential data exfiltration
| 162 | Webhook endpoints: 0 |
Webhook reference - potential data exfiltration
| 166 | 1. Crear 1 webhook endpoint en destino (events: ...) |
Webhook reference - potential data exfiltration
| 212 | ✓ Webhook endpoint creado en destino: we_1TabcXyz |
Webhook reference - potential data exfiltration
| 214 | ✓ Secrets inyectados en Supabase (3 nombres: STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PUBLISHABLE_KEY) |
Webhook reference - potential data exfiltration
| 223 | ✗ Webhook endpoint creado en destino |
Webhook reference - potential data exfiltration
| 226 | ✓ Webhook destino eliminado |
Webhook reference - potential data exfiltration
| 278 | | `E_LIMIT_REACHED` | >16 webhook endpoints en la cuenta destino | Borrar los huérfanos: `stripe webhooks list --limit=100` y purga manual | |
Access to system keychain/keyring
| 275 | | `E_DECRYPT_FAILED` | macOS Keychain inaccesible o passphrase distinto | Re-ingresar passphrase / re-crear keychain entry | |
External URL reference
| 143 | platform_url: "https://{ref}.supabase.co/functions/v1/stripe-webhook", |
External URL reference
| 252 | - Verifica que aparece en https://dashboard.stripe.com/{test|live}/customers de la cuenta DESTINO. |