bc-payments

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt’s examples and request templates require including payment access tokens, card numbers, or stored-instrument tokens directly in request headers/bodies (e.g., Authorization: PAT {payment_access_token} and raw card JSON), which would force an agent to output secret values verbatim when generating API calls unless alternative secure patterns (env vars/CLI auth) are explicitly used.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly and primarily a payment integration: it documents BigCommerce Payment Processing API endpoints to create payment access tokens and to POST payments (including raw card payloads and tokenized stored instruments), plus refund, void, and capture actions. These are concrete APIs for processing payments and managing money flow (process payment, refunds, captures), not generic tooling. Therefore it provides direct financial execution capability.