extension-stripe

SUSPICIOUS: the core payment capability is coherent with the stated Stripe purpose and the data flow appears intended for Stripe, but the skill carries medium supply-chain risk because it is installed transitively from a GitHub skills repo and relies on a non-reviewable prefabricated Stripe module. Credential scope is proportionate, yet the raw Stripe secret key handling and opaque module reduce assurance.