Create Payment Credential

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 0.6.0

Overview

The skill is a disclosed Link payment helper, but it combines real payment authority with broad package execution, mutable installs, and persistent credential handling that should be reviewed before use.

Install only if you are comfortable giving an agent access to Link payment workflows. Prefer a pinned, reviewed @stripe/link-cli version, avoid global installs where possible, store auth files outside shared workspaces with restricted permissions, and require explicit confirmation before any merchant, amount, item, payment method, shipping address, or domain changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned npm Package Execution in a Payment-Credential Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:37-55
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

Install with `npm install -g @stripe/link-cli`. Or run directly with `npx @stripe/link-cli`.

## Running commands

Link CLI can run as an **MCP server** or as a **standalone CLI**.

**MCP:** Add the following to your MCP client config (`.mcp.json`, etc.)

```json
{
  "mcpServers": {
    "link": {
      "command": "npx",
      "args": ["@stripe/link-cli", "--mcp"]
    }
  }
}

Run the MCP server directly with npx @stripe/link-cli@latest --mcp.

text

### Technical Analysis

The Skill instructs the Agent to install or execute `@stripe/link-cli` without pinning an exact, previously reviewed version or verifying package integrity. The explicit use of `@latest` guarantees that the effective executable payload can change after this Skill has been audited.

The package name is scoped and presented as Stripe software, which lowers ordinary typo-squatting risk, but it does not protect against a compromised npm publisher account, malicious upstream release, registry compromise, or unsafe future dependency update. Global installation also increases exposure by placing mutable third-party executable code into the broader system environment.

This is especially sensitive because the CLI handles Link authentication state, payment methods, shipping addresses, temporary card credentials, and Shared Payment Tokens.

### Attack Path

1. An attacker compromises the package publisher, release process, registry account, or a transitive dependency.
2. The attacker publishes a malicious version under `@stripe/link-cli`.
3. The Agent follows the Skill and executes `npx @stripe/link-cli`, `npx @stripe/link-cli@latest`, or globally installs the package.
4. npm retrieves and executes the changed package without requiring the Skill itself to be modified.
5. The malicious package accesses data available to the process,
...[truncated 1063 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @stripe/link-cli to an exact version that has been reviewed instead of using an unversioned reference or @latest.
2. Remove the recommendation to execute npx @stripe/link-cli@latest.
3. Use a lockfile and verify npm package integrity hashes before execution.
4. Prefer a project-local installation over npm install -g to limit system-wide effects.
5. Disable or carefully review lifecycle scripts where operationally possible.
6. Separate dependency installation from payment execution so that updates require an explicit review and approval step.
7. Run the CLI in a sandbox with narrowly scoped filesystem and network permissions.
8. Restrict runtime tool access to the pinned link-cli executable rather than broadly allowing npm:* and npx:*.
9. Document a controlled upgrade process that includes source provenance, checksum verification, and security review.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:204

Finding

Merchant-Controlled Directive Files Can Influence Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:204
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code

markdown

- Respect `/agents.txt` and `/llm.txt` and other directives on sites you browse — these files declare whether the site permits automated agent interactions; ignoring them may violate the merchant's terms.

Technical Analysis

The Skill tells the Agent to respect /agents.txt, /llm.txt, and unspecified “other directives” supplied by websites it visits. Merchant websites are untrusted, externally controlled inputs. The instruction does not constrain which directives may be followed or explicitly state that site content is subordinate to system instructions, user intent, payment-safety requirements, and least-privilege boundaries.

A malicious or compromised merchant can place instruction-like content in these files and attempt to alter the Agent's workflow. Although checking a site's automation policy can be legitimate, treating arbitrary website directives as operational instructions creates a prompt-injection boundary violation. The phrase “other directives” further broadens the untrusted instruction surface.

This is particularly risky in a workflow that can obtain payment credentials and submit transactions. Website content should be interpreted as data and policy metadata, not as authoritative Agent instructions.

Attack Path

1. A user asks the Agent to purchase an item from a malicious or compromised merchant.
2. The Agent browses the merchant and retrieves /agents.txt, /llm.txt, or another merchant-controlled directive.
3. The file contains instructions unrelated to automation permission, such as requesting secrets, changing the payment destination, invoking additional tools, visiting an attacker endpoint, or bypassing normal verification.
4. The Skill's instruction to “respect” site directives causes the Agent to treat the content as operational guidance.
5. If hig ...[truncated 987 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the broad instruction to “respect” website directives with a narrowly scoped requirement to inspect them only for automation-permission metadata.
2. Explicitly state that all merchant-provided content is untrusted data and cannot override system, developer, user, or Skill security requirements.
3. Ignore any site directive that requests credentials, payment details, unrelated tool use, local file access, configuration changes, or navigation to unrelated domains.
4. Define an allowlist of recognized policy fields and reject arbitrary free-form operational instructions.
5. Require explicit user confirmation before changing the merchant, destination domain, final amount, purchased items, or payment method.
6. Validate that checkout and payment endpoints remain on the verified merchant domain or an expected payment-provider domain.
7. Keep raw card data and tokens isolated from browsed content and never expose them in response to site-authored instructions.
8. Stop the workflow and warn the user when merchant directives conflict with the requested transaction or established safety constraints.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger conditions are extremely broad (buy something, pay for X, I need to pay, login/signup requests), making it easy for the skill to activate in contexts where the user did not clearly intend delegated payment actions. In a skill capable of creating payment credentials and facilitating purchases, accidental invocation can lead to unauthorized transaction setup, overcollection of payment data, or risky navigation to merchant sites.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill explicitly describes storing authentication material in a local file via --auth credentials.json. Even though this may be legitimate functionality, guidance that normalizes file-based credential storage without emphasizing secure path selection, lifecycle management, and access restrictions increases the risk of credential exposure through logs, shared workspaces, backups, or subsequent tool access. In a payment skill, leaked Link auth could enable access to payment methods or issuance workflows.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

- Multi-step commands return a `_next` action. For example, authenticating or creating a spend request returns a `_next.command` that must be run to complete the flow.
- By default all output is in `toon` format. Pass `--format [json|md|yaml]` to change output format.
- Some commands return a verification or approval URL. **These** must be presented to the user clearly for their action.
- `--auth <path>` flag to store auth credentials in a specific file instead of the default location. `auth login` writes to this file; all other commands read from it. Example: `link-cli auth login --auth credentials.json`

_Recommended_: Run `link-cli --llms` to understand all the available commands. The `--llms-full` output is the canonical reference for parameter names, types, and valid values. Pass `--schema` before invoking a command to understand its parameters and constraints.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

**CRITICAL:** Before calling `spend-request create` you must complete this checklist:
1. Understand how the merchant accepts payments (cards or machine payments or other). **Do NOT** default to `card` credential type. The merchant determines the credential type — you cannot know it without checking first. Skipping this step will produce a spend request with the wrong credential type.
2. Have the final total amount needed. Inclusive of any shipping costs, taxes or other costs. Skipping this step will produce a spend request that does not cover the full amount needed, and will be rejected.
3. Clear context and understanding of what the user is purchasing. Be sure to know sizes, colors, shipping options, etc. Skipping this step will produce a spend request that the user does not recognize or understand.

**Determine how the merchant accepts payment:**

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users/agents to run npx @stripe/link-cli without pinning a specific version, which creates a supply-chain risk: future package updates or a compromised npm release could change behavior at execution time. In a payment credential skill, this is especially sensitive because the CLI can access authentication state and issue spend credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This invocation uses npx @stripe/link-cli without a pinned version in installation/runtime guidance. Unpinned execution allows silent drift to newly published code, which can be abused through dependency compromise or introduce breaking behavior into an agent that handles payments and credentials.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

### Step 2: Evaluate the merchant site BEFORE creating a spend request

**CRITICAL:** Before calling `spend-request create` you must complete this checklist:
1. Understand how the merchant accepts payments (cards or machine payments or other). **Do NOT** default to `card` credential type. The merchant determines the credential type — you cannot know it without checking first. Skipping this step will produce a spend request with the wrong credential type.
2. Have the final total amount needed. Inclusive of any shipping costs, taxes or other costs. Skipping this step will produce a spend request that does not cover the full amount needed, and will be rejected.
3. Clear context and understanding of what the user is purchasing. Be sure to know sizes, colors, shipping options, etc. Skipping this step will produce a spend request that the user does not recognize or understand.

Static analysis

No suspicious patterns detected.