# Stripe Webhook Review

> Stripe Webhook Review is a paid API for AI agents from api.aiskills402.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-29).

Analyzes a Stripe webhook handler's source code and reports up to five critical security vulnerabilities that could allow forged or replayed events to trigger money movement, access grants, or order fulfillment

## Facts

- Endpoint: GET https://api.aiskills402.com/v1/skills/stripe-webhook-review/file?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stripe-webhook-review-1c5d558a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ChtHrLdjW98rAnNlytVfy

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stripe-webhook-review-1c5d558a
```

Example prompt: Can you review my Stripe webhook handler code for security issues — specifically check if it's vulnerable to forged or replayed events, missing signature verification, or raw body parsing mistakes?

## When to prefer this

Choose this endpoint when you need a fast, focused security audit specifically targeting Stripe webhook handler code for the five most dangerous classes of vulnerability (signature bypass, replay attacks, body parsing order, recency tolerance, duplicate events). Prefer it over a general code review tool when the handler is Stripe-specific and you want actionable, pinpointed findings rather than broad linting or style feedback.

## Known failure modes

- No code file provided — returns an error requesting a webhook handler file
- Code is not a recognizable webhook handler — may return no findings or a parsing error
- File too large or malformed — may result in a processing error
- Non-Stripe webhook handlers submitted — findings may not apply
- Network timeout if the service is temporarily unavailable

## How this service works

Stripe Webhook Review — Reviews ONE Stripe webhook handler (the route code, in any language or framework) for the five mistakes that let a forged or repeated event move money, grant access or ship goods, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches a body parsed or re-serialized before the signature is checked, a handler that never checks the signature, a recency tolerance switched off or set huge, no reco…

## Output

A structured list of up to five security findings, each with a fixed code identifier, the exact location in the code, an explanation of why it is dangerous, and a recommended fix — or exactly 'No findings' if the handler is secure. Findings cover: body parsed before signature check, missing signature verification, recency tolerance disabled or set too large, no duplicate event detection, and insecure event re-fetching.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD"
     ],
     "type": "string"
    },
    "headers": {
     "type": "object",
     "additionalProperties": {
      "type": "string"
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "file": {
   "name": "SKILL.md",
   "content": "<the SKILL.md file>",
   "encoding": "utf-8"
  },
  "name": "Stripe Webhook Review",
  "skill": "stripe-webhook-review",
  "sha256": "<sha256 of SKILL.md>",
  "receipt": {
   "tx": "0x<settlement transaction>",
   "settled": true
  },
  "version": "1.0.0",
  "redownload": {
   "url": "<api>/v1/purchases/<token>",
   "token": "<64 hex chars>"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stripe-webhook-review-1c5d558a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.aiskills402.com](https://www.zero.xyz/host/api.aiskills402.com/llms.txt)