stripe-link-cli

SUSPICIOUS mainly due to transitive skill installation and autonomous payment capability, not because of hidden malware behavior. The core Stripe CLI usage is consistent with the stated purpose and uses a verifiable Stripe-owned package, but the skill facilitates real-world purchases, writes sensitive payment credentials locally, and adds an unpinned third-party skill-install step that raises trust and safety risk.