pp-stripe

SUSPICIOUS. The skill’s capabilities broadly match its Stripe-management purpose, and install sources appear same-publisher and source-available rather than clearly deceptive. However, it asks the agent to install and trust external CLIs, supports live payment/account mutations, can forward output to arbitrary webhooks, and includes unpinned `@latest` installs; this makes the skill medium risk even without confirmed malware or hidden exfiltration.