Security audit

stripe-direct-connection

Security checks across malware telemetry and agentic risk

Overview

This Stripe skill is mostly transparent about its purpose, but it gives agents broad financial write authority without clear confirmation gates.

Use this only with trusted agents and preferably with test-mode or least-privilege Stripe credentials. Require a human approval step outside the skill before refunds, cancellations, invoice finalization, subscription item deletion, or dispute submissions, and avoid placing secrets or unnecessary customer/payment details into prompts or feedback.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The schema exposes capabilities far beyond the stated 'customers' billing operations, including merchant-account introspection, product/price/catalog creation, account balance access, disputes, documentation search, and planning workflows. This scope mismatch can cause an agent or operator to grant the skill broader authority than intended, increasing the chance of unauthorized financial, operational, or data-impacting actions under a misleading description.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The feedback-submission action sends data to an external endpoint that is unrelated to core Stripe account operations. In a payment skill, that creates an unexpected outbound data path where user or agent context, quoted messages, and tool-specific details may be exfiltrated without matching the declared purpose of the integration.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The integration recommender is an advisory workflow, not a direct Stripe account operation, yet it is bundled into a high-privilege payment skill. Mixing planning/Q&A with write-capable financial actions expands attack surface and can encourage unnecessary invocation of a broad-permission skill for low-risk advisory tasks.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation keywords include broad phrases such as general billing and subscription language that can match ordinary user conversations, causing the skill to activate outside the user's clear intent. In this skill's context, accidental activation is more dangerous than usual because the tool exposes write-capable financial operations like refunds, cancellations, and invoice creation.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill advertises full read/write Stripe access, including refunds, subscription cancellation, invoice finalization, and dispute updates, but does not require explicit user confirmation or approval gates for destructive actions. In a financial tool, this creates a high risk of unauthorized or mistaken state-changing transactions with direct monetary and customer-impact consequences.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The cancel_subscription action performs an irreversible or business-impacting billing change but the schema provides no warning, confirmation requirement, or precondition checks. In an agent-driven environment, ambiguous requests or prompt-manipulated instructions could lead to accidental service termination, revenue loss, and customer harm.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Refunds directly move money and are often irreversible from the merchant's perspective, yet the action description lacks any caution about financial impact, fraud risk, or confirmation requirements. An agent using this tool could issue mistaken or socially engineered refunds, causing immediate monetary loss and audit/compliance issues.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The dispute update action allows immediate submission of evidence to the bank via submit=true but does not emphasize the legal/financial significance or the risk of submitting incomplete or incorrect evidence. In practice, premature submission can damage a merchant's ability to contest chargebacks effectively and may expose sensitive customer information unnecessarily.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.