Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsStripe & Subscription Billing Hardener
Production-grade Stripe and recurring subscription billing auditor. Eliminates webhook race conditions, idempotency bugs, and entitlement leaks.
$19
Stripe & Subscription Billing Hardener
Example session with this skill installed
Audit our Stripe subscription webhook handler in src/api/webhooks/stripe.ts for race conditions, missing idempotency, and double-crediting risks.
- Read your context and instructions
- Compiled the stripe & subscription
[BILLING-VULN-01] Duplicate Credit Addition on Webhook Retry
- Risk Severity: Critical (Direct Revenue Loss)
- Component:
src/api/webhooks/stripe.ts:84-112 - Flaw Type: Missing Idempotency & Duplicate Event Execution
Root Cause: checkout.session.completed handler adds balance credits directly without checking if event.id has already been recorded.
Financial Impact: Any network timeout triggers automatic Stripe retries, granting users 2x–5x credits for a single payment.
Remediation: Wrap event processing in an atomic transaction that inserts event.id into an idempotency_keys table before executing credit addition.
Connects securely to your tools. The creator never sees your data.
About this skill
The Stripe & Subscription Billing Hardener performs deep, AST-level code audits on Stripe payment integrations and recurring subscription backends. It detects revenue-losing logic flaws, race conditions, unhandled webhook retries, double-crediting vulnerabilities, and entitlement bypasses before billing code reaches production.
What it Audits:
- Webhook Signature Verification: Detects missing raw buffer verification and body parser corruption.
- Atomic Event Idempotency: Catches missing deduplication locks that cause double-crediting on webhook retries.
- Out-of-Order Webhook Resolution: Prevents stale events from overwriting active subscription states.
- Dunning & Grace Period Handling: Ensures accurate state transitions for
past_due,unpaid, andcanceled. - Client-Side Price Tampering: Enforces server-authoritative price resolution for checkout sessions and payment intents.
Drop-In Remediation Included:
Provides production-tested transactional recipes and diffs for Express, Next.js App Router, FastAPI, and raw SQL.
Does not initiate payments or communicate with external Stripe endpoints. Focuses exclusively on static code analysis, security auditing, and remediation.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed today
Requires