skills.rest
amoai-tech
amoai-techCOMMUNITY
Explore all skills by this author →
GitHub

stripe-review

Reviews Stripe checkout, webhook, and refund code for idempotency and signature defects.

1|Updated Sep 15, 2026
Search Tags:#code review#security#payments#stripe#webhooks#idempotency#checkout
One-click install
npx skills add https://github.com/amoai-tech/mdeai --skill stripe-review-amoai-tech
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: stripe-review
Source: https://github.com/amoai-tech/mdeai/tree/main/.claude/skills/stripe-review
Command: npx skills add https://github.com/amoai-tech/mdeai --skill stripe-review-amoai-tech

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Payment code changes can introduce duplicate ticket issuance, replayed webhooks, forged payment status, or leaked secrets. This Skill provides a focused review checklist for Stripe-related pull requests so reviewers catch signature, idempotency, replay, authority, and secret-boundary defects before merge. ## Core Features & Use Cases - Webhook Verification Review: Confirms signatures are verified from the raw request body before events are trusted. - Idempotency and Replay Checks: Ensures duplicate webhook delivery cannot duplicate tickets, ledger rows, inventory changes, or payouts. - Server-Side Authority Enforcement: Flags any reliance on client-controlled payment status, amounts, prices, or ownership, and checks secret keys stay server-only. - Use Case: A pull request modifies the ticket checkout flow and webhook handler. Apply this Skill to verify the handler reconciles state against Stripe event data, deduplicates deliveries, and keeps test/live credentials separated. ## Quick Start Review this pull request touching the Stripe checkout and webhook handlers for signature, idempotency, replay, and secret-boundary defects.

Frequently Asked Questions about stripe-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Stripe webhook code for security issues?▼

Verify the handler validates the Stripe signature against the raw request body before trusting any event. Then confirm side effects are idempotent so duplicate deliveries cannot create duplicate tickets, ledger rows, or payouts.

How to prevent duplicate tickets from Stripe webhook retries?▼

Make webhook and fulfillment side effects idempotent by keying protected writes on the Stripe event or payment identifier. Duplicate delivery of the same event must converge on exactly one business effect such as one issued ticket.

When should this Stripe review checklist be applied?▼

Apply it only when changed code touches payments, checkout, webhooks, refunds, Connect, or payment-derived fulfillment such as ticket issuance. It is not intended for unrelated application changes.

Why should client payment status never be trusted as final?▼

Client-controlled status, amounts, prices, and ownership can be forged or stale. Payment state must be reconciled server-side against trusted Stripe event data before granting tickets, inventory changes, or payouts.

What secret-handling rules apply to Stripe keys in code reviews?▼

Secret keys and webhook signing secrets must remain server-only and never ship to the client. Test and live mode resources and credentials must also be kept strictly separated.

Related Skills

Explore More Software Engineering Skills→
ksciuskscius
2

adding-stripe

Automate Stripe Checkout sessions, webhooks, and customer portal integration.

Community
Intermediate
nakamotosainakamotosai

Webhook

Verify HMAC signatures, prevent replay attacks, and deduplicate webhook events.

Community
Advanced
AlvaFGAlvaFG

epagos-echeckout

Automate ePagos eCheckout flows for card payments with token retrieval and webhooks.

Community
Advanced
marquesfelipmarquesfelip

billing-event-idempotency

Prevent duplicate Stripe webhook event processing with database-backed deduplication.

Community
Advanced