pci-compliance

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains examples that hard-code API secret placeholders (e.g., stripe.api_key = "sk_...") and raw card data (e.g., "4242424242424242", "cvc": "123"), which encourage embedding secrets or sensitive values verbatim in generated code or outputs.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit, specific payment gateway integrations and functions that perform monetary actions: it imports the Stripe SDK, sets stripe.api_key, calls stripe.Charge.create to create a charge, and modifies customers to store payment methods. These are direct payment execution APIs (payment gateway) rather than generic tooling, so this grants Direct Financial Execution capability.