stripe

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs embedding Stripe secret keys directly in CLI args and example code (e.g., --api-key=${STRIPE_SECRET_KEY} and secret_key="rk_test_..."), which forces inclusion or echoing of secret values verbatim rather than keeping them only in environment/config stores.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The MCP server exposes Stripe tools including search_stripe_documentation/search_stripe_resources which read free text from Stripe’s knowledge base or resources based on the agent’s runtime inputs, allowing an outsider-supplied query string to be ingested by the LLM during retrieval.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill configures a remote HTTP MCP transport pointing at https://mcp.stripe.com which is contacted at runtime to provide/execute MCP tools and therefore represents a runtime external dependency that can execute remote actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a Stripe payment integration. It defines MCP tools and commands that use Stripe secret/restricted API keys, lists many mutating payment tools (create_invoice, create_payment_link, create_refund, cancel_subscription, update_subscription, etc.), and contains sample code that sets stripe.api_key and creates transfers (stripe.Transfer.create) and accounts. These are direct payment/transfer operations (sending refunds, creating payment intents/links, performing vendor payouts), i.e., explicit financial execution capability.