stripe-one-time-payment

SUSPICIOUS: The stated purpose is plausible and the credential scope is mostly proportionate for a Stripe deployment template, with secrets routed to official Stripe/Vercel contexts. However, the skill is internally inconsistent with the referenced repo and publisher identity, and it relies on cloning a mutable GitHub template before npm install. This looks more like a mismatched or sloppy template reference than confirmed malware, but the provenance inconsistency and install trust issues make it suspicious rather than benign.