stripe-automation

SUSPICIOUS. The skill’s Stripe capabilities match its stated purpose, but its trust and data-flow model are problematic: it relies on a discontinued Rube MCP endpoint and routes Stripe auth/actions through Composio-managed infrastructure instead of direct Stripe APIs. This is not confirmed malware, but it creates medium-high security risk due to third-party credential delegation, stale install guidance, and autonomous financial-action capability.