link-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly describes retrieving one-time card credentials (number, CVC, expiry, billing) via spend-request retrieve --include card and using them to complete payments, which requires the agent to handle and output secret payment data verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes remote code at runtime via npx -y @stripe/link-cli (repo: https://github.com/stripe/link-cli), which fetches and executes the external package and thus directly controls the CLI prompts/behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payment agent for Stripe Link. It provides specific commands to list payment methods, create spend requests with amount/currency/merchant, poll for approval, reveal one-time card credentials (number, CVC, expiry), and execute payments via the Machine Payments Protocol (mpp pay). These are concrete payment primitives (generating/use of one-time cards and executing payments) — not generic tooling — and therefore constitute direct financial execution capability.