Security audit

Native Stripe

Security checks for vulnerabilities and agentic risk

Overview

This Stripe skill is mostly transparent about connecting to Stripe, but it gives an agent live financial read/write power with weak scoping and no extra safeguards for refunds or updates.

Review before installing. Use a restricted Stripe key and test-mode key first, avoid exposing a full live secret key to an agent, and treat refund/customer update commands as real account-changing operations. The package should add resource allowlists and explicit confirmation or dry-run behavior for mutations before production use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/stripe_query.py:121
Finding: Unrestricted Stripe API Resource Paths Exceed the Declared Skill Scope
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation understates or inaccurately describes behavior, including undeclared access to balance_transactions and broader update semantics than advertised. In a financial integration, behavior/documentation mismatch is dangerous because operators may approve or run the skill under false assumptions, leading to unexpected access to sensitive financial data or unintended account modifications.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The generic create and update command structure accepts arbitrary resource values, so a caller can attempt POST operations beyond the manifest-declared customer/refund scope. In a skill context, this creates an integrity risk because the tool advertises narrower mutating capability than the code actually exposes, increasing the chance of unauthorized or unintended changes to Stripe resources.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README explicitly advertises destructive operations such as refunds and customer updates without warning that these actions affect real Stripe account data and may be irreversible or financially impactful. In an agent context, presenting mutation-capable commands casually increases the chance of accidental misuse, especially if the configured key is a live secret key.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The setup instructs users to export a Stripe secret key, including a live production key example, and then use direct API access without any warning about the sensitivity of the credential or the consequences of using it against production data. In a skill intended for an agent, this can normalize broad credential exposure and enable unintended reads or writes across the entire Stripe account if the environment is shared or the agent is misused.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes Python scripts that require environment-variable access and outbound network access to Stripe, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This weakens sandboxing and reviewability because consumers cannot clearly see or constrain the operational capabilities the skill needs before execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill documents write operations such as refunds and customer updates without a prominent warning that the provided secret key may be a live production key and that actions can have irreversible real-world financial impact. In a Stripe context, omission of this warning increases the chance of accidental refunds or modifications against live customer/payment data.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 102)May include surrounding context.
md
import urllib.parse import urllib.request BASE_URL = "https://api.stripe.com/v1" # Fields to show in table output per resource TABLE_FIELDS = {

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/stripe_query.py (reported line 13)May include surrounding context.
python
import urllib.parse import urllib.request BASE_URL = "https://api.stripe.com/v1" # Fields to show in table output per resource TABLE_FIELDS = {

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description enumerates supported Stripe resources as charges, customers, invoices, subscriptions, payment intents, refunds, products, and prices, plus customer/refund mutations. The code also exposes balance_transactions in the CLI and table definitions, expanding the skill beyond the described scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script performs direct HTTPS requests to api.stripe.com using user-supplied query parameters and an authorization secret, which can transmit customer, invoice, and payment-related data off-host. Although the module docstring says it calls Stripe directly, there is no runtime warning, confirmation, or explicit user-facing disclosure before sending potentially sensitive account data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The create and update paths perform live Stripe mutations immediately with no confirmation, dry-run mode, or extra guardrails. In an agent/tooling environment, this raises the risk of accidental refunds or customer record changes from ambiguous prompts, operator error, or misuse of the tool.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest description says the skill supports "creating/updating customers and refunds," which implies customer creation is part of the skill's implemented scope. In this file, all concrete usage examples show listing/querying resources, creating refunds, and updating customers, but no example or documented command exists for creating customers.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.