stripe-directory

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required CLI workflow runs stripe directory search and feeds the returned provider listings and linked documentation to the agent, and those listings can carry text written by third-party providers rather than Stripe, so this is a public registry the agent must query, which rates low.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). Direct financial operation in scope: the skill resolves and routes payments and donations ("Pay my Twilio bill", "Donate $1 to Stripe Climate"). Its payment section says to "Use the appropriate payment skill or documented payment flow to execute the action" (SKILL.md:105), and the Inspect guide is used when the user intends to "buy, pay, donate, subscribe, or book" (SKILL.md:46). This is delegated execution through transaction routing, not a development or information-only use. Control gap: the only safeguard documented is an agent-followed requirement to show details and obtain explicit user approval (SKILL.md:105, 112). That is an instruction, not a service or execution-layer authentication or authorization check for the payment route. The CLI setup and authentication steps (SKILL.md:54, 76) cover directory access, not payment authorization, and no named dependency documents payment authentication. Provisioning costs are excluded as service costs. Severity is High.