create-payment-credential

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires retrieving raw payment credentials (card PAN/CVC and one-time SPTs) and passing raw WWW-Authenticate headers into CLI commands (e.g., --challenge '' and printing/filling card details), which forces the agent to handle and potentially output secret values verbatim—an exfiltration risk despite recommendations to mask or write to a file.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's Core flow Step 2 explicitly instructs the agent to "Navigate to the merchant page — browse it, read the page content" and to probe merchant URLs and parse WWW-Authenticate headers via the mpp pay flow, meaning the agent will fetch and interpret arbitrary public merchant web content that directly determines credential type and subsequent payment actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires running "npx @stripe/link-cli" (which fetches and executes remote package code from the npm registry, e.g. https://registry.npmjs.org/@stripe/link-cli or via npx @stripe/link-cli@latest) at runtime, so it executes remote code and is a required dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides tools and step-by-step commands to create and use payment credentials (virtual card PANs and Shared Payment Tokens) via Link/Stripe. It includes commands to authenticate, create spend requests, retrieve card numbers (number, cvc, exp), and perform programmatic payments (mpp pay) — i.e., obtaining and using credentials to execute real purchases. This is a specific payment integration (Stripe/Link) and therefore grants direct financial execution authority.