stripe-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill embeds API keys, webhook secrets, and client keys as literal strings in example code (e.g., stripe.api_key = "sk_test_...", endpoint_secret = 'whsec_...', pk_test_...), which requires the LLM to handle or reproduce secret values verbatim and thus risks secret exfiltration.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly a Stripe payment integration and includes direct calls to the Stripe API to create payment sessions, PaymentIntents, Subscriptions, Customers, and Refunds (including setting stripe.api_key). Those are specific payment gateway operations that allow an agent to initiate charges, manage payment methods, create subscriptions, and issue refunds — i.e., direct financial execution capabilities.