extension-stripe

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires collecting a Stripe "secret key" into a StripeConfiguration (secretKey : Text) and passing it to backend methods like setStripeConfiguration/getStripeConfiguration, which forces the agent to handle and transmit the secret value verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed for payment processing via Stripe. The provided module exposes StripeConfiguration (including a secretKey) and public functions createCheckoutSession and getSessionStatus. The backend wires a shared createCheckoutSession that calls Stripe.createCheckoutSession, and the frontend calls actor.createCheckoutSession and redirects users to the returned Stripe checkout URL. These are specific payment-gateway operations (initiating payments and managing Stripe credentials), i.e., direct financial execution capability.