Skip to content
Back to skills

Stripe Projects

CSecurity

Use when the user needs to provision a third-party service available on https://projects.dev/providers; create or retrieve a provider/service API, key or token; sign up for a service; or references projects.dev. Handles the full flow from checking provider availability through project initialization, then hands off to locally installed skills.

  • 383 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added June 6, 2026
toolsgobashgitapisecurity

Works with

  • cli
  • api

Security analysis

C67/100
  • mediumUses curl or wget to download content
  • criticalExfiltrates credentials via HTTP — exact pattern from Snyk ToxicSkills study

Pro shows the line behind each finding and how to fix it

Scanned June 6, 2026

npx -y skills add Asymmetric-al/core --skill stripe-projects --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Stripe Projects?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Stripe Projects
[![Security: C — Skills Directory](https://www.skillsdirectory.com/api/skills/asymmetric-al-stripe-projects/badge)](https://www.skillsdirectory.com/skills/asymmetric-al-stripe-projects)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: stripe-projects
description: >-
  Use when the user needs to provision a third-party service available on
  https://projects.dev/providers; create or retrieve a provider/service API, key
  or token; sign up for a service; or references projects.dev. Handles the full
  flow from checking provider availability through project initialization, then
  hands off to locally installed skills.
allowed-tools:
  - Bash(stripe *)
  - Bash(which stripe)
  - Bash(brew install stripe/stripe-cli/stripe)
  - Bash(brew upgrade stripe/stripe-cli/stripe)
  - Bash(scoop bucket add stripe https://github.com/stripe/scoop-stripe-cli.git)
  - Bash(scoop install stripe)
  - Bash(sudo apt *)
  - Bash(curl -s https://packages.stripe.dev/*)
  - WebFetch
  - Skill
  - Read

---

## Stripe Projects — Service Provisioning

Provision third-party services and retrieve API keys/tokens using the Stripe Projects CLI plugin.

## Workflow

### Step 1: Verify Provider Availability

Before doing anything else, fetch `https://projects.dev/providers` and check whether the requested provider appears in the directory listing.

- If the provider **isn’t listed** on that page, inform the user that Stripe Projects **doesn’t support** this provider and stop.
- If the provider **is listed**, continue.

### Step 2: Ensure Stripe CLI is Installed

Check if the Stripe CLI is available:

```bash
which stripe && stripe --version
```

If not installed, install based on the user’s platform:

**macOS (Homebrew):**

```bash
brew install stripe/stripe-cli/stripe
```

**Linux (Debian/Ubuntu via APT):**

```bash
curl -s https://packages.stripe.dev/api/security/keypair/stripe-cli-gpg/public | gpg --dearmor | sudo tee /usr/share/keyrings/stripe.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/stripe.gpg] https://packages.stripe.dev/stripe-cli-debian-local stable main" | sudo tee -a /etc/apt/sources.list.d/stripe.list
sudo apt update
sudo apt install stripe
```

**Windows (Scoop):**

```bash
scoop bucket add stripe https://github.com/stripe/scoop-stripe-cli.git
scoop install stripe
```

If installed, but the version is lower than 1.40.0, then upgrade based on the user’s platform:

**macOS (Homebrew):**

```bash
brew upgrade stripe/stripe-cli/stripe
```

or follow instructions at https://docs.stripe.com/stripe-cli/upgrade for other platforms.

### Step 3: Ensure Stripe Projects Plugin is Installed and on Latest

```bash
stripe plugin install projects
```

### Step 4: Search the Catalog

Confirm the specific provider is available and validates the specific service:

```bash
stripe projects search <query> --json
```

If `result_count` is 0, inform the user the service was not found in the catalog and stop.

### Step 5: Initialize a Project

Check if a project is already initialized:

```bash
stripe projects status --json
```

If not initialized:

```bash
stripe projects init --json --yes
```

Note: If the user hasn’t logged in to the Stripe CLI, `projects init` will redirect them to a browser to either log in to an existing Stripe account or create a new Stripe Projects account. When this happens, prompt the user:

> ▎ Stripe Projects is redirecting you to the browser to authenticate. ▎ - If you have an existing Stripe account, log in with your credentials. ▎ - If you’re new, you can create a free Stripe Projects account in seconds. ▎ ▎ Complete the sign-in in your browser, then come back here and let me know when you’re done.

Wait for the user to confirm before proceeding.

### Step 6: Hand Off to local stripe-projects-cli skill

Important: After the project is initialized, always use the `stripe-projects-cli` skill installed at `.claude/skills/stripe-projects-cli` in the local project directory (invoke via the Skill tool with name `stripe-projects-cli`) to continue the workflow for adding services. Print out the env variable names returned in a table, but never their values.

### Step 7: Provider Recommendations

After a successful ‘add’ output, you must give the user helpful suggestions on other providers services available on Stripe Projects catalog that could be complementary (different primary category) or helpful - 3 to 5 suggestions. NEVER show fabricated commands to provision these services, only ones from the `stripe projects catalog` output if at all.

## Non-Interactive Mode

Always use `--json --yes` flags to suppress interactive prompts. If a paid service requires confirmation, add `--confirm-paid-service`.

## Working Agreement

- Don’t hand-edit CLI-managed files under `.projects` or the generated `.env` output.
- NEVER look at any files in the .projects directory. The CLI manages everything for you.
- NEVER look at the .env file. The CLI manages everything for you.

## Error Handling

- Provider not listed at `projects.dev/providers` → stop early, tell the user it’s not supported
- Stripe CLI missing → install per platform instructions above
- Plugin missing → install via `stripe plugin install projects`
- `projects init` triggers browser login → prompt user, wait for confirmation
- Service not in catalog → inform user, suggest `stripe projects catalog --json` to browse alternatives

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…