Security audit

stripe-direct-connection

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly for remote Stripe account control, but it needs review because it can perform high-impact billing actions and relies on mutable remote instructions without strong local safeguards.

Install only if you are comfortable giving an AgentPMT-hosted tool broad Stripe read/write authority. Use restricted Stripe credentials where possible, require human confirmation before refunds, cancellations, invoice finalization, subscription changes, or dispute submission, review outbound text before sending feedback or integration-planning notes, and prefer pinned or internally reviewed setup artifacts over the unpinned install commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:77
Finding: Remote Responses Can Redirect Agent Output and Workflow
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: schema.md:1057
Finding: User Messages and Internal Context Can Be Transmitted Without Adequate Data-Minimization Controls
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:135
Finding: Setup Instructions Install Mutable Third-Party Content Without Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill advertises destructive financial capabilities including refunds, subscription cancellation, invoice finalization, and dispute updates without a prominent warning or mandatory confirmation pattern. In an agentic environment, this can lead to irreversible or hard-to-reverse account changes, financial loss, or compliance problems if actions are triggered from ambiguous prompts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation keywords are very broad payment-related phrases such as subscriptions, billing, checkout, and Stripe-adjacent intents, which can cause an agent to select this skill in ordinary financial conversations. Since the skill enables full read/write Stripe operations, over-selection increases the chance of unauthorized or premature access to customer/payment actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to install supporting skills via npx skills add ... without pinning an exact package/version. Because npx resolves the latest published package at execution time, a compromised upstream release, dependency hijack, or malicious update could cause arbitrary code or unreviewed skill content to be fetched during installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This installation command relies on an unpinned npx package invocation, which introduces supply-chain risk. Anyone following the skill may retrieve a newer or tampered package than the author reviewed, enabling malicious code execution or unsafe skill installation paths.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx skills without an explicit version allows runtime resolution of whatever package version is current in the registry. In a security-sensitive workflow that grants access to payment operations, this increases the chance of installing compromised tooling or altered transitive dependencies.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The grouped install script also uses unpinned npx, creating the same supply-chain exposure at install time. Because this skill is for high-impact Stripe operations, compromise of the installer path could directly enable credential theft or unauthorized financial actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This line repeats the unpinned npx installation pattern, making the setup dependent on mutable upstream content. That is dangerous because the installed support skill affects authentication and payment-tool connectivity, so a malicious update could subvert later Stripe interactions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This command again depends on an unpinned npx package fetch, which is a classic supply-chain weakness. Attackers who gain control of the package, dependency chain, or referenced repo state can deliver altered code or instructions to anyone installing the skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The reference section continues to advertise unpinned npx installation instructions, preserving a mutable trust boundary. In this context, the risk is amplified because the installed skill chain ultimately brokers access to financial systems and credentials.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This unpinned install instruction exposes users to retrieving unreviewed future package contents. If exploited, the attacker could modify setup behavior, capture secrets, or steer agents toward malicious MCP endpoints before Stripe access is established.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Another mutable npx install command creates avoidable supply-chain risk. Because the surrounding ecosystem includes wallet/payment setup and MCP connectivity, compromise here could have downstream effects far beyond a normal low-risk utility install.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
md
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - No-account AgentAddress/x402 setup: ../agentpmt-no-account-agentaddress-x402 (ClawHub: `agentpmt-no-account-agentaddress-x402`, page: https://clawhub.ai/agentpmt/agentpmt-no-account-agentaddress-x402; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-no-account-agentaddress-x402`) - Marketplace product: https://www.agentpmt.com/marketplace/stripe-direct-connection - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.
md
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - No-account AgentAddress/x402 setup: ../agentpmt-no-account-agentaddress-x402 (ClawHub: `agentpmt-no-account-agentaddress-x402`, page: https://clawhub.ai/agentpmt/agentpmt-no-account-agentaddress-x402; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-no-account-agentaddress-x402`) - Marketplace product: https://www.agentpmt.com/marketplace/stripe-direct-connection - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill exposes subscription cancellation as a simple write action with no embedded confirmation or warning guidance, increasing the chance that an agent triggers irreversible customer-impacting billing changes from ambiguous prompts. In an agentic environment, missing friction around destructive financial operations materially raises the risk of accidental or socially engineered misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Refund creation directly moves money and is often irreversible or operationally sensitive, yet the schema provides no warning or confirmation guidance. This makes accidental refunds, fraud-induced refunds, or agent misunderstandings more likely, especially because only a PaymentIntent ID is needed to initiate the action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Finalizing an invoice can lock billing details and trigger downstream collection, customer notifications, or accounting effects, but the action description lacks cautionary guidance. In a high-privilege billing skill, omission of such warnings increases the chance of premature or unauthorized billing progression.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes a direct Stripe operational tool for payments, subscriptions, invoicing, refunds, disputes, balance, and customer workflows through hosted tool calls. However, this schema also exposes search_stripe_documentation and stripe_integration_recommender, which provide advisory/documentation and integration-planning capabilities rather than direct account operations. Those capabilities go beyond the described operational scope of the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: send_stripe_mcp_feedback submits user or agent feedback about Stripe's MCP server tools, which is not necessary for performing Stripe payments, subscriptions, invoicing, refunds, disputes, or customer management. This is a meta-telemetry/support capability about the tooling itself, not a direct requirement of the skill's stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The dispute update flow includes a submit flag that can immediately send evidence to the bank, but the schema does not prominently warn about the finality and procedural significance of submission. Agents may unintentionally submit incomplete or inaccurate evidence, harming dispute outcomes or creating legal/compliance issues.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.