Skip to content

chore(deps): update stripe/agent-toolkit digest to 150d4d4 - #697

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/stripe-agent-toolkit-digest
Open

chore(deps): update stripe/agent-toolkit digest to 150d4d4#697
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/stripe-agent-toolkit-digest

Conversation

@renovate

@renovate renovate Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
stripe/agent-toolkit digest ec93d4c → 150d4d4

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Jul 3, 2026
@toolhive-release-app

toolhive-release-app Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🛡️ Skill Security Scan Results

✅ stripe-best-practices

  • Status: Passed
  • Findings: 2

❌ stripe-projects

  • Status: Failed
  • Findings: 8
  • Blocking: 3

Blocking issues:

  • [LLM_DATA_EXFILTRATION] (HIGH) The skill provisions third-party services and manages credentials/API keys via stripe projects env --json and stripe projects variables set. The workflow involves retrieving and displaying environment variable names and potentially values. The instruction 'never print secret values in your response' is a soft guideline that relies on the agent's compliance rather than a technical control. The --value <value> parameter in stripe projects variables set could expose secrets in shell history, process listings, or agent logs. Additionally, the skill reads .env files and .projects/ directory contents when explicitly requested by the user, creating a risk of inadvertent secret exposure. (SKILL.md)
  • [LLM_PROMPT_INJECTION] (HIGH) The skill instructs the agent to install and then immediately invoke a dynamically-downloaded skill (stripe-projects-cli) from .claude/skills/stripe-projects-cli/SKILL.md after running stripe projects init. This externally-sourced skill is fetched at runtime via the Stripe CLI plugin and its content is not bundled with or audited as part of this skill package. The agent is instructed to unconditionally trust and execute instructions from this dynamically installed skill using the Skill tool. If the Stripe CLI plugin, its distribution channel, or the projects init process were compromised, the injected SKILL.md could contain arbitrary malicious instructions that the agent would follow without user awareness. (SKILL.md)
  • [ATR_2026_00010] (CRITICAL) Pattern detected: stripe projects init installs the stripe-projects-cli skill locally at .claude/skills/stripe-projects-cli. This skill contains the full post-init command referenc (SKILL.md:62)

Allowlisted (not blocking):

  • MANIFEST_MISSING_LICENSE (Allowed: stripe/agent-toolkit is licensed MIT at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ upgrade-stripe

  • Status: Passed
  • Findings: 4
  • Allowed (not blocking): 1
    • MANIFEST_MISSING_LICENSE (Allowed: stripe/agent-toolkit is licensed MIT at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

Summary: Scanned 3 skill(s), found 3 blocking issue(s).

⚠️ Action Required: Review the blocking findings. Add a justified entry to the skill's security.allowed_issues[] in its spec.yaml if the finding is a false positive.

@renovate
renovate Bot force-pushed the renovate/stripe-agent-toolkit-digest branch from 0de3e3d to 663ace7 Compare July 3, 2026 10:12
@renovate renovate Bot changed the title chore(deps): update stripe/agent-toolkit digest to b8d7e28 chore(deps): update stripe/agent-toolkit digest to 84c364c Jul 27, 2026
@renovate
renovate Bot force-pushed the renovate/stripe-agent-toolkit-digest branch from 0230665 to df9798a Compare July 27, 2026 09:43
@JAORMX JAORMX mentioned this pull request Jul 27, 2026
Merged
JAORMX added a commit that referenced this pull request Jul 27, 2026
@JAORMX
fix: update skill specs for upstream restructures, removals, and scan…
a780dc7 
…ner FPs (#808)

* fix: update skill specs for upstream restructures, removals, and scanner FPs

Path fixes for upstream repo restructures:
- mongodb/agent-skills: atlas-stream-processing renamed to
  mongodb-atlas-stream-processing
- datadog-labs/agent-skills: dd-llmo/ restructured to
  agent-observability/ (4 skills renamed)

Removed skills deleted upstream:
- firebase/agent-skills: developing-genkit-js/go/dart removed

Security scanner false positive allowlists added for:
- grilling (ATR_2026_00051 — conversational prose)
- cloudflare (BEHAVIOR_BASH_TAINT_FLOW — curl examples in docs)
- claude-api (10 new ATR_2026_* — API documentation patterns)
- agentic-actions-auditor (5 rules — security audit skill with
  intentional attack pattern docs)
- gha-security-review (BEHAVIOR_BASH_TAINT_FLOW — attack pattern
  docs)
- mongodb-schema-design (BEHAVIOR_BASH_TAINT_FLOW — mongo shell
  examples)
- firebase-firestore (BEHAVIOR_BASH_TAINT_FLOW — Firestore API
  examples)
- skill-writer (BEHAVIOR_BASH_TAINT_FLOW — meta-skill code
  patterns)

All refs updated to match renovate digest proposals (full SHAs).
Local validation passes for all modified skills.

Not addressed (left as open renovate PRs with genuine findings):
- stripe-projects (#697): prompt injection + skill discovery abuse
- gemini-api-dev/interactions-api (#688): fabricated model names +
  training-data override

* fix: add missing scanner allowlist entries for new digest content

The updated upstream digests introduced new reference file content
that triggers additional scanner rule IDs. All verified as false
positives against actual upstream content:

- agentic-actions-auditor: ATR_2026_00012/00040/00066
- claude-api: ATR_2026_00032/00113
- codeql: ATR_2026_00010/00012/00066/00111
- firebase-firestore: ATR_2026_00010/00012
- gha-security-review: ATR_2026_00040/00066/00161
- mongodb-atlas-stream-processing: ATR_2026_00010/00013
- mongodb-schema-design: ATR_2026_00012/00062
- sharp-edges: ATR_2026_00012/00161
- skill-writer: ATR_2026_00012/00088/00111
- yara-rule-authoring: ATR_2026_00004/00012/00063/00066

* chore: bump spec.version for all modified skills

Required by skillversionbump check — minor bumps for content
changes, patch bump for cloudflare (allowlist-only change).

* fix: use category-level allowlisting for ATR pattern rules

The scanner's LLM meta-analyzer produces non-deterministic results
across runs — new upstream content triggers different rule IDs each
time. Playing whack-a-mole with individual ATR_2026_* rule IDs is
unsustainable.

Switch to category-level POLICY_VIOLATION allowlisting for skills
where ALL ATR pattern matches are inherently false positives:

- Security audit/analysis skills (agentic-actions-auditor,
  gha-security-review, sharp-edges, yara-rule-authoring, codeql,
  semgrep-rule-creator, constant-time-analysis): reference files
  intentionally describe attack patterns for detection
- API/SDK documentation skills (claude-api, firebase-firestore,
  firebase-data-connect-basics, mongodb-schema-design,
  mongodb-atlas-stream-processing): pattern matches are on
  documentation prose, code examples, and API references
- Meta skills (skill-writer): pattern matches are on skill
  authoring and evaluation documentation
- Datadog observability skills (agent-observability-*): pattern
  matches are on evaluation and tracing documentation

* fix: use correct lowercase category names and add prompt_injection

The scanner assigns categories in lowercase (policy_violation,
prompt_injection, command_injection). Also adds:
- prompt_injection category allowlisting alongside policy_violation
- command_injection for semgrep-rule-creator
- LLM_SKILL_DISCOVERY_ABUSE for firebase-firestore (official Firebase
  activation directive, not commercial hijack)
- PG_PII_SSN_HARVESTING for agent-observability-eval-bootstrap

* fix: add remaining allowlist entries for trace-rca and sharp-edges

- agent-observability-trace-rca: PG_EXFIL_MARKDOWN_LINK (Datadog
  trace links to user's own tenant, same as eval-bootstrap)
- sharp-edges: command_injection (Python eval/exec examples in
  security analysis docs)
@renovate renovate Bot changed the title chore(deps): update stripe/agent-toolkit digest to 84c364c chore(deps): update stripe/agent-toolkit digest to 150d4d4 Jul 29, 2026
@renovate
renovate Bot force-pushed the renovate/stripe-agent-toolkit-digest branch from 213a7fa to d2ca3d6 Compare July 29, 2026 06:54
@renovate

renovate Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants