agent-stripe

The skill’s business purpose is coherent, and its Stripe-focused commands are proportionate to payment investigation. However, it relies on external CLIs whose provenance was not verified and explicitly routes Stripe API credentials into one of those binaries; combined with endpoint override support, this makes the skill high risk despite no confirmed malicious behavior.