payments-stripe

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow is Stripe webhook handling, where the agent reads the RAW HTTP request body (await req.text()) and verifies it; this body is outsider-authored free text from Stripe’s servers (public third-party webhook payload) that is then ingested into the LLM context via the code path that processes the event.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a Stripe payments integration: it contains direct Stripe API calls (stripe.checkout.sessions.create) to start subscriptions/charges, webhook handling (stripe.webhooks.constructEvent) to process payment and subscription lifecycle events, and relies on secret keys/env vars. This is a specific payment-gateway integration designed to initiate and manage financial transactions and subscription state — not a generic tool — so it grants direct financial execution capability.