upgrade-stripe

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes examples that embed API keys/tokens directly in code and curl commands (e.g., 'sk_test_xxx' in require(...) and curl -u), which encourages the agent to include secrets verbatim in outputs/commands and poses an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly about Stripe, a payment gateway, and contains concrete API usage and code snippets (e.g., initializing the Stripe client with secret keys, curl to /v1/customers, examples of creating customers). It is specifically designed for Stripe integration and managing API behavior—i.e., a payment gateway integration—so it grants direct financial execution capability.