pp-stripe

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to install an external binary via npm (@mvanhorn/printing-press-library) and Go (github.com/mvanhorn/printing-press-library/...), which constitutes an unverified third-party runtime external dependency from an unofficial repository origin.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates a Stripe CLI (stripe-pp-cli) capable of direct financial operations such as creating charges, refunds, payouts, transfers, and managing payment intents/subscriptions. However, qualifying independent service-layer authentication or access control is documented (authenticated via STRIPE_SECRET_KEY or stripe-pp-cli auth set-token <key>, validated and enforced by Stripe API credentials).