payment-integration

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The client code calls loadStripe (from @stripe/stripe-js) which at runtime loads and executes Stripe's remote script (https://js.stripe.com/v3/) to perform checkout, so the skill relies on that external script being fetched and executed in users' browsers.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to integrate with Stripe (a payment gateway): it sets up the Stripe SDK, provides a checkout component (payment button), webhook handlers, and subscription management, and requires Stripe secret keys. These are specific payment gateway capabilities that enable sending/receiving money and managing subscriptions.