stripe-api-integration@1.0.4
CAUTION· static onlyPublisher claims: "Builds and debugs Stripe integrations: payments, subscriptions, Checkout, invoices, webhooks, Connect, disputes, tax. Use when a charge, refund, payout or subscription behaves wrong, when a webhook never arrives or its signature fails, when a card is declined or stuck on 3D Secure, when a customer was billed twice or the amount came out 100x off, when proration, trials, dunning or a plan change has to be exactly right, when splitting money across a marketplace with Connect, when disputes, chargebacks or fraud rules need work, when the payout does not match the bank, or when moving from test mode to live. Covers Payment Intents, Checkout Sessions, Payment Links, the Billing Portal, metered and tiered pricing, Stripe Tax, Radar, test clocks, idempotency, API versioning, and reconciliation. Not for choosing which payment provider to use (`payments`), PayPal integrations (`paypal`), App Store and Play Store purchases (`in-app-purchases`), or tracking the subscriptions you pay for as a consumer (`subscriptions`)." Observed in sandbox: static analysis only — behavior not yet observed.
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-10 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
…n a price, product, coupon or promotion code is created, retired or replaced**, write its row to `## Catalog` in `~/Clawic/data/stripe-api-integration/memory.md` — id, model, amount with currency, interval, what it replaced — in the same t…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.…f the fix produced a procedure, save it as `artifacts/runbook-<symptom>.md` and add its `## Boxes` line to `memory.md` in the same turn. The second occurrence of a symptom should cost minutes, not …Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.…`, move the whole section into it, **delete the section from `memory.md`**, and add its line to `## Boxes`. `memory.md` keeps the index line and nothing else. 4. **Precedence**: never leave a copy b…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.… the retry schedule, grace period or terminal behavior is decided or changed**, write it to `## Integration Shape` in `~/Clawic/data/stripe-api-integration/memory.md`, and save the reasoning — attempt count against price point, measured re…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.… blanket 3DS, exemption-first, per-segment rules, or a specific recovery flow — write it to `## Integration Shape` in `~/Clawic/data/stripe-api-integration/memory.md`, and if the reasoning took work (fraud rate by segment, conversion measu…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.… the idempotency-key convention or the metadata schema is decided or changed**, write it to `## Integration Shape` in `~/Clawic/data/stripe-api-integration/memory.md`, and record the convention itself under `conventions` in `config.yaml` —…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim ivangdavila: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.