laravel-stripe-connect

SUSPICIOUS: The core Laravel+Stripe Connect content is coherent and largely benign, and the scanner's command-injection hit is a false positive in documentation/code context. The main risk is the mandatory use of third-party skills/services (fuse-ai-pilot and Context7), which expands trust and data flow beyond Stripe/Laravel and makes the skill less self-contained than its stated purpose suggests.

No clear malicious behavior or obfuscation is present. The code performs ordinary Stripe payment processing, but the confirmation and refund methods lack visible ownership/authorization checks, and the multi-seller transfer flow lacks idempotency protection. These are security concerns that should be addressed or verified in surrounding routes and policies.