stripe

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow is Stripe Checkout/webhook verification where the only outsider-provided free text ingested by the LLM would be the webhook payload body/headers from incoming HTTP requests, which can be attacker-controlled by posting to the webhook endpoint (still verified by signature but the payload text is read/processed).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for integrating with the Stripe payment gateway. It constructs a Stripe client using secret keys and pinned API version and contains direct API calls that create Checkout Sessions (one-time and subscription), create billing portal sessions, and guidance on handling webhooks and idempotency. The presence of stripe.checkout.sessions.create, stripe.billingPortal.sessions.create, and usage of STRIPE_SECRET_KEY/STRIPE_WEBHOOK_SECRET shows the skill is specifically designed to move and manage money via Stripe.