payment-integration
Facilitates secure payment integration with Stripe and PayPal, ensuring compliance and best practices for checkout and subscriptions.
Install this skill
Security score
The payment-integration skill was audited on Mar 2, 2026 and we found 12 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 3 | description: Integrate Stripe, PayPal, and payment processors. Handles checkout flows, subscriptions, webhooks, and PCI compliance. Use PROACTIVELY when implementing payments, billing, or subscription |
Webhook reference - potential data exfiltration
| 32 | - Webhook handling for payment events |
Webhook reference - potential data exfiltration
| 41 | 5. Comprehensive webhook handling for async events |
Webhook reference - potential data exfiltration
| 45 | ### Webhook Security & Idempotency |
Webhook reference - potential data exfiltration
| 46 | - **Signature Verification**: ALWAYS verify webhook signatures using official SDK libraries (Stripe, PayPal include HMAC signatures). Never process unverified webhooks. |
Webhook reference - potential data exfiltration
| 47 | - **Raw Body Preservation**: Never modify webhook request body before verification - JSON middleware breaks signature validation. |
Webhook reference - potential data exfiltration
| 48 | - **Idempotent Handlers**: Store event IDs in your database and check before processing. Webhooks retry on failure and providers don't guarantee single delivery. |
Webhook reference - potential data exfiltration
| 50 | - **Server Validation**: Re-fetch payment status from provider API. Never trust webhook payload or client response alone. |
Webhook reference - potential data exfiltration
| 60 | - Payment processor collapse during traffic spike → webhook queue backups, revenue loss |
Webhook reference - potential data exfiltration
| 61 | - Out-of-order webhooks breaking Lambda functions (no idempotency) → production failures |
Webhook reference - potential data exfiltration
| 64 | - Webhook signature skipped → system flooded with malicious requests |
Webhook reference - potential data exfiltration
| 70 | - Webhook endpoint implementations |