stripe-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill embeds API keys and webhook secrets as string literals (e.g., "sk_test_...", "pk_test_...", "whsec_..."), which encourages including secret values verbatim in generated code or outputs and therefore risks secret exfiltration.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a Stripe payment integration. The documentation includes Stripe API usage and concrete functions that create payments and manage money: setting stripe.api_key, creating checkout sessions and PaymentIntents, creating subscriptions, issuing refunds, attaching payment methods, and handling webhook events. These are direct payment gateway operations (Stripe) that can execute financial transactions.