{"uid":"cap_ChtHrLdjW98rAnNlytVfy","slug":"stripe-webhook-review-1c5d558a","name":"Stripe Webhook Review","description":"Stripe Webhook Review — Reviews ONE Stripe webhook handler (the route code, in any language or framework) for the five mistakes that let a forged or repeated event move money, grant access or ship goods, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches a body parsed or re-serialized before the signature is checked, a handler that never checks the signature, a recency tolerance switched off or set huge, no reco…","url":"https://api.aiskills402.com/v1/skills/stripe-webhook-review/file?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD"],"type":"string"},"headers":{"type":"object","additionalProperties":{"type":"string"}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"ok":true,"file":{"name":"SKILL.md","content":"<the SKILL.md file>","encoding":"utf-8"},"name":"Stripe Webhook Review","skill":"stripe-webhook-review","sha256":"<sha256 of SKILL.md>","receipt":{"tx":"0x<settlement transaction>","settled":true},"version":"1.0.0","redownload":{"url":"<api>/v1/purchases/<token>","token":"<64 hex chars>"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_kaCJKvqw7qvc9e-9pCv0Z","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes a Stripe webhook handler's source code and reports up to five critical security vulnerabilities that could allow forged or replayed events to trigger money movement, access grants, or order fulfillment","exampleAgentPrompt":"Can you review my Stripe webhook handler code for security issues — specifically check if it's vulnerable to forged or replayed events, missing signature verification, or raw body parsing mistakes?","exampleUseCases":[{"title":"Express.js webhook signature audit","prompt":"Here's my Node.js Express route that handles Stripe webhook events — can you check it for the common security mistakes like missing signature checks or parsing the body before verifying the signature?"},{"title":"Replay attack protection check","prompt":"I have a Python Flask Stripe webhook handler and I'm worried it might be vulnerable to replay attacks. Can you review the code and tell me if my recency tolerance is set correctly and if I'm checking for duplicate events?"},{"title":"Pre-deployment payment webhook review","prompt":"Before I ship this Go Stripe webhook handler to production, can you audit it for the five mistakes that would let someone forge or replay a payment event to get free goods or access?"}],"resultDescription":"A structured list of up to five security findings, each with a fixed code identifier, the exact location in the code, an explanation of why it is dangerous, and a recommended fix — or exactly 'No findings' if the handler is secure. Findings cover: body parsed before signature check, missing signature verification, recency tolerance disabled or set too large, no duplicate event detection, and insecure event re-fetching.","failureModes":["No code file provided — returns an error requesting a webhook handler file","Code is not a recognizable webhook handler — may return no findings or a parsing error","File too large or malformed — may result in a processing error","Non-Stripe webhook handlers submitted — findings may not apply","Network timeout if the service is temporarily unavailable"],"whenToPreferThis":"Choose this endpoint when you need a fast, focused security audit specifically targeting Stripe webhook handler code for the five most dangerous classes of vulnerability (signature bypass, replay attacks, body parsing order, recency tolerance, duplicate events). Prefer it over a general code review tool when the handler is Stripe-specific and you want actionable, pinpointed findings rather than broad linting or style feedback.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T06:32:11.638Z","isFirstParty":false,"canonicalSlug":"stripe-webhook-review-1c5d558a"}