stripe-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's example code assigns API keys and webhook secrets directly in plaintext (e.g., stripe.api_key = "sk_test_..." and endpoint_secret = "whsec_..."), which instructs embedding secret values verbatim in generated code or outputs.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly a Stripe payment-integration tool. The documentation and code snippets show direct use of the Stripe API (setting stripe.api_key, creating checkout sessions, PaymentIntents, Subscriptions, Refunds, attaching payment methods, etc.), which are concrete payment gateway operations that can move money or trigger refunds. Therefore it grants direct financial execution authority.