stripe

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to paste their Stripe secret key and then instructs running a shell command that embeds that key verbatim (ruby ... save_token.rb 'PASTED_KEY'), forcing the LLM/output to handle the secret directly and risking exfiltration.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a Stripe integration (a payment gateway). It requires a Stripe secret API key and exposes direct REST operations for payments and account management: creating payment intents/charges, creating subscriptions, creating customers, creating products/prices, and reading/updating account balance. Those are specific, purpose-built financial execution APIs (not generic tools) and can move or authorize money (even though some actions state "requires user confirmation"). Therefore it meets the Direct Financial Execution criteria.