payment-failure-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). SKILL.md describes a Stripe MCP workflow that retrieves first-party Stripe account data via MCP tool calls (e.g., search_stripe_resources/ GetCharges/ GetPaymentIntents/ GetInvoices) but does not include any runtime ingestion of outsider-authored free text without first selecting specific Stripe resources.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires a Stripe MCP connection (OAuth or restricted key) and references specific Stripe API operations and helpers (GetMcpTools, stripe_api_search, stripe_api_details, stripe_api_read, GetCharges, GetPaymentIntents, GetInvoices). This is a payment-gateway-specific integration (Stripe), so it constitutes direct financial execution capability risk even though the documented workflow focuses on read/list/audit actions — the presence of Stripe MCP credentials and API hooks is a payment gateway integration per the policy.