stripe-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds and demonstrates assigning API keys and webhook secrets as literal strings (e.g., stripe.api_key = "sk_test_...", endpoint_secret = "whsec_...", Stripe("pk_test_...")), which requires the agent to handle or reproduce secret values verbatim and therefore poses an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly a Stripe payment integration and contains specific API calls that can move money or manage payment instruments: e.g., stripe.checkout.Session.create, stripe.PaymentIntent.create/confirm, stripe.Subscription.create, stripe.Refund.create, stripe.Customer.create, stripe.PaymentMethod.attach, stripe.Dispute.modify, webhook handling with secrets, and examples using secret API keys. Those are payment-gateway operations that directly create charges, subscriptions, and refunds — i.e., direct financial execution authority.