Demo verdict. This skill and its findings are illustrative data from our product demo, not a real detonation. Real verdicts are on the leaderboard.
stripe/agent-toolkit@2.1.0
VERIFIEDVerified PublisherPublisher claims: "Create payment links, customers, and invoices from your agent." Observed in sandbox: calls api.stripe.com only, touches nothing outside the project, writes no memory. Behavior matches declaration across all 3 scenarios.
Registry Anthropic partner directoryPublisher stripe · verified org · signing key rotated 47d agoInstalls 607KLast detonated 5d ago
Is stripe/[email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios) on 2026-10-22 and scored it 98/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. The publisher is verified. Summary: calls api.stripe.com only, touches nothing outside the project, writes no memory. Behavior matches declaration across all 3 scenarios.
Behavior trace
Honeypot run · 52 s · 3 scenarios · 0 deviationst+CategoryObserved action
0.3spromptSKILL.md parsed · 0 hidden instructions · 0 imperative overrides
1.8snetworkPOST https://api.stripe.com/v1/payment_links · auth header = decoy test key, correctly scoped
2.2sfilesystemread ./.env (STRIPE_SECRET_KEY only) · no reads outside project
9.4smemoryno writes to MEMORY.md, CLAUDE.md, or .cursorrules
9.6stools4 tools registered · no description overlap with adjacent servers
52sclaimedCreated 3 payment links, 1 customer, 1 invoice in the decoy account. Matches README.
Static findings
LOW
Remote installer piped to shellscripts/setup.sh:12 · pinned SHA-256, signed by stripe; acceptable, notedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07No other findings across 2,114 lines in 9 files.