OpenAI Codex security directory

Stripe

Published by Stripe

High risk

Connects your assistant to Stripe payment and business-management workflows. Create products, prices and payment links; manage payments, subscriptions and invoices. Work with refunds, disputes and customers, and get integration-development guidance.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

  • Provisions third-party infrastructure via Stripe Projects and uploads Stripe Apps: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
  • Deletes/voids Stripe objects and project variables: Can delete records, files, projects, messages, or resources that may be difficult to recover.
  • Writes app scaffolds, plans and .env files: Can read, create, or change files on the local filesystem or in a selected project.
  • Retrieves provider API keys and accepts terms of service automatically: Can create or change persistent records, files, projects, permissions, settings, or credentials.
  • OAuth/agent key held for Stripe account: Uses credentials, OAuth grants, API keys, or tokens that may remain valid after the current session.
  • Skills run Stripe CLI and package installs via shell: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
  • Refunds, Treasury money movement and agent purchases: Can initiate purchases, paid jobs, payments, refunds, infrastructure spend, or other financial activity.

Available capabilities

This add-on exposes 7 tools or capabilities.

  • connect-recommend
  • stripe-apps
  • stripe-best-practices
  • stripe-directory
  • stripe-docs
  • stripe-projects
  • upgrade-stripe

The interactive security report will load automatically.