stripe-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples/instructions to pass API keys directly on the command line (e.g., stripe login --api-key sk_test_xxx) which requires the agent to insert secret values verbatim into commands.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is the Stripe CLI, an official payment-gateway tool that explicitly provides commands to create payment_intents, create/manage customers and subscriptions, and otherwise interact with Stripe's payment APIs (and supports providing API keys). Those commands are specifically designed to initiate and manage financial transactions and billing—i.e., the tool's primary purpose is payment execution—so it constitutes direct financial execution capability. Note: the doc even shows how to authenticate with API keys (including live keys) and create payment resources.