stripe-mor

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The document includes curl examples that embed API secret strings verbatim (e.g., -u "sk_test_xxx:") and references production key patterns (sk_live_*), which would require an agent to handle or emit secret values directly in commands or outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 本スキルは Stripe Webhook のリクエストボディ（c.req.text() で取得され署名検証後に constructEventAsync に渡る）を実行時に読み取る一方、そのボディ内容は外部投稿者（Stripe 側送信者/攻撃者が成りすませる可能性がある）由来の自由テキストになり得ます。

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The document is an integration guide for Stripe Managed Payments and contains explicit payment gateway operations: curl commands creating Products and Prices with API keys, instructions to store STRIPE_SECRET_KEY/WEBHOOK_SECRET, code that creates a Stripe client and calls stripe.checkout.sessions.create (creating subscriptions/checkout sessions), and webhook handling for payment/subscription events. These are specific APIs/functions to move and manage money (payment gateway), so it grants direct financial execution capability.