medusa

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes examples that embed plaintext secrets and passwords directly in commands and configuration (e.g., CLI flags with -p, .env entries with credentials and JWT secrets), which would require an LLM to output secret values verbatim and thus is high risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly documents payment integration with Stripe: it instructs installing the @medusajs/payment-stripe module, configuring it with STRIPE_API_KEY in medusa-config, and adding Stripe as a payment provider in the admin UI. These are specific payment gateway integrations that enable processing money/transactions, so this skill grants Direct Financial Execution capability.