laravel-security

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes literal secret-like values (e.g., APP_KEY, DB_PASSWORD, STRIPE_KEY=sk_live_...) and a command that injects secrets into the environment, which risks requiring the LLM to handle or reproduce secrets verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation explicitly references a payment gateway (Stripe) and includes code related to processing payments. Examples: the .env STRIPE_KEY entry and secret validation for services.stripe, the CSRF exclusion for stripe/* webhooks, a named rate limiter for 'payments', and a ProcessPaymentJob that "Process payment" and accepts paymentIntentId/cardFingerprint. These are specific payment-related artifacts (Stripe keys, webhook route, and payment processing job), which qualify as Direct Financial Execution capability.