Security Audit
stripe-integration
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
stripe-integration received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Hardcoded Stripe API Test Key in Example, Hardcoded Stripe Webhook Test Secret in Example.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Hardcoded Stripe API Test Key in Example The skill documentation provides Python code examples where `stripe.api_key` is hardcoded directly within the code (`stripe.api_key = "sk_test_..."`). While this is a test credential, this practice is highly insecure. If developers copy this example and replace it with a live production key, it leads to direct exposure of sensitive credentials in source code, which can be easily compromised if the code repository is accessed. Advise users to never hardcode API keys or secrets directly in code. Instead, recommend using environment variables, a secure configuration management system (e.g., AWS Secrets Manager, HashiCorp Vault), or a dedicated secrets file that is excluded from version control. Update the examples to reflect this best practice (e.g., `stripe.api_key = os.environ.get("STRIPE_SECRET_KEY")`). | LLM | SKILL.md:78 | |
| HIGH | Hardcoded Stripe Webhook Test Secret in Example The skill documentation provides a Python code example for webhook handling where `endpoint_secret` is hardcoded directly within the code (`endpoint_secret = 'whsec_...'`). While this is a test credential, this practice is highly insecure. If developers copy this example and replace it with a live production webhook secret, it leads to direct exposure of sensitive credentials in source code, which can be easily compromised if the code repository is accessed. Advise users to never hardcode webhook secrets directly in code. Instead, recommend using environment variables, a secure configuration management system, or a dedicated secrets file that is excluded from version control. Update the examples to reflect this best practice (e.g., `endpoint_secret = os.environ.get("STRIPE_WEBHOOK_SECRET")`). | LLM | SKILL.md:170 |
Scan History
Embed Code
[](https://skillshield.io/report/99a8b3a5dc33cab9)
Powered by SkillShield