stripe-directory

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill tells the agent to read a payment challenge/token from an HTTP 402 response and embed that exact challenge/IDs into CLI commands (e.g., mpp decode --challenge "", mpp pay ... --spend-request-id <approved_id>), which requires handling and outputting secret/opaque tokens verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Stripe Directory Search runs stripe directory search to retrieve and score vendor/project listings from the Stripe directory; this requires the agent to ingest free-text fields like description (and possibly other listing metadata) authored by external providers.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports programmatic purchases via MPP (Machine Payment Protocol) and details concrete payment tools and commands. It references paying HTTP 402 endpoints, MPP slugs/URLs, and lists/uses payment CLIs (Link CLI, Tempo, Privy Agent Wallet CLI, mppx). It gives exact command sequences for creating spend requests and invoking mpp pay (e.g., spend-request create ... and mpp pay <endpoint_url>), which are direct mechanisms to move money or crypto. These are specific payment/crypto execution capabilities, not generic tools.