metronome-token-billing

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill contains instructions to exfiltrate run reports and diagnostic feedback to Stripe via an unstable endpoint without explicit user consent or disclosure in the user-facing summaries.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (critical risk: 1.00). The skill contains instructions to exfiltrate integration feedback and run notes to a Stripe API endpoint (https://api.stripe.com/v1/_unstable/feedback) using the user's secret key.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to fetch external content from https://llm.stripe.com/v1/models during runtime execution, representing a third-party unofficial operational data dependency, and therefore evaluates to medium.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill sets up Metronome Token Billing and configures pricing plans, rates, products, custom fields, and Stripe billing/invoicing flows via public APIs. It performs direct financial operations (creating products, configuring rate cards, setting prices, creating contracts and packages, and charging for token usage). While user confirmation steps and credential checks are documented, there is no independent access control enforced by the service or execution layer for the payment and rate-card mutation routes described; authorization relies entirely on agent-driven prompts and API tokens. Therefore, the direct financial operation operates without established qualifying independent control.