A webhook handler that trusts req.body lets anyone send a fake "payment succeeded" event, and an amount taken from the request lets a buyer pay 1 cent for anything. This skill finds those and seven other Stripe integration mistakes before you go live, and tells you how to fix each one.

Your agent runs a scanner on your code (Node.js, Next.js, Python, PHP, Ruby, front-end files), config files and .env files. Comments are skipped, so a signature check that was commented out counts as missing. It tells browser code from server code, and follows request values through variables (const { amount } = req.body). It never calls Stripe. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Keys are never printed.

What it checks

BLOCK (fix before shipping)

• S01: a live secret key, live restricted key or webhook signing secret in code or config

• S02: a secret key in browser code (loadStripe with sk_, client components, NEXT_PUBLIC_ or VITE_ variables)

• S03: a webhook handler with no constructEvent (signature) check

• S04: amount, unit_amount or line_items taken from the request

REVIEW (check before release)

• S11: a test secret key written in code

• S12: the body parsed or re-encoded before the signature check

• S13: PaymentIntents, charges, refunds or payouts created without an idempotency key

• S14: card numbers or CVC codes on your own form or server

• S15: checkout.session.completed handled without checking payment_status

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (server, webhook and React checkout), and the real report the scanner produces on the risky one

Limits

It reads code as text: values are followed within one file, so checks done in another module are not seen. Dashboard settings, hosting environment variables and Radar rules are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 14 files: SKILL.md, the scanner in scripts/ (4 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.