trigger-dev-v2

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes secret-like placeholders (e.g., OPENAI_API_KEY=sk-..., STRIPE_SECRET_KEY=sk_live_...) and explicit examples to create/push .env files and env vars, which can lead the LLM to request, handle, or emit secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly references payment gateway integration and Stripe-specific items: it lists "stripe" in Integrations and "Available integrations" (@trigger.dev/stripe), includes a webhook handler example for Stripe events (checkout.session.completed, customer.subscription.updated), and references STRIPE_SECRET_KEY in env var guidance. Those are specific payment-related integrations/tools (Stripe) that can be used to execute or affect payments—so this grants direct financial execution capability.