stripe-billing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md’s webhook runtime path, the handler reads the outsider-controlled HTTP request body via request.text() and feeds it into Stripe’s signature verification and event construction.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs agents to add and call external agent tooling and skill indexes at runtime (e.g., claude mcp add --transport http stripe https://mcp.stripe.com/ and the machine-readable skills index https://docs.stripe.com/.well-known/skills/index.json / npx skills add https://docs.stripe.com), which are runtime fetches that can supply prompts/instructions to the agent.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly about Stripe payment integration and includes concrete, actionable calls and tooling for moving money: Stripe CLI commands, initialization with STRIPE_SECRET_KEY, stripe.checkout.sessions.create, stripe.customers.create, stripe.subscriptions.update, webhook handling (constructEvent), and refund handling. These are specific payment-gateway APIs (Stripe) that grant the agent direct financial execution authority.