Individual skill
stripe-webhook-review
Review Next.js Stripe webhook route handlers for missing signature verification, JSON parsed before verification, missing or non-status-aware idempotency on event.id (pending/completed), unsafe reprocessing of pending events, and billing periods read from items.data[0]. Use when the user asks to review a Stripe webhook, idempotency, duplicate events, or payments before launch.
skills/stripe-webhook-review/SKILL.md
Source commit 8a7193870ac3ea0027fb8735b48d63baf2e01f75
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- Yes
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 0
- Repository last updated
- Oct 17, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- claude-skills Repository topic
- claude-code Repository topic
- code-review Repository topic
- codex Repository topic
- cursor Repository topic
- nextjs Repository topic
- rls Repository topic
- security Repository topic
- skill-md Repository topic
- data Derived category
- engineering Derived category
- engineering-web Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 3,632 bytes
Read excerpt
# stripe-webhook-review
Read-only review. Don't edit files unless the user asks for the fixes afterwards.
## Scope
Find the handlers: `grep -rl "constructEvent\|stripe-signature\|webhooks" app/ src/ pages/` (route handlers under `app/api/**/route.ts` or `pages/api/**`). Read each one and the helpers it calls (claim/complete functions, sync functions).
## Checks
For each finding, give file:line, the check id, severity, and the fix.
| Id | Severity | Look for | Fix |
|---|---|---|---|
| S1 | critical | No `stripe.webhooks.constructEvent(...)` (or `constructEventAsync`) before the event is trusted | Verify `constructEvent(rawBody, signature, secret)` first; return 400 on failure. |
| S2 | critical | `await request.json()` (or a parsed body) used before or instead of the raw body | `const body = await request.text()` and pass that string to `constructEvent`. |