stripe-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes code examples that hardcode Stripe API keys and webhook secrets (e.g., stripe.api_key = "sk_test_..." and endpoint_secret = "whsec_..."), which teaches or requires embedding secrets directly in generated code/output and therefore poses a high exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly and specifically designed for payment processing via Stripe. It contains direct Stripe API calls that can create charges and checkout sessions (stripe.checkout.Session.create, stripe.PaymentIntent.create/confirm), create/manage subscriptions (stripe.Subscription.create), attach payment methods, and issue refunds (stripe.Refund.create). It requires/uses API keys and is clearly intended to perform financial transactions and refund operations — i.e., move money. This matches the "Payment Gateways" category for Direct Financial Execution.