Stripe Payment Integration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.0

Overview

This Stripe skill is transparently about payment operations, but it gives an agent live financial powers without clear confirmation and scoping safeguards.

Review before installing. Use Stripe test mode first, prefer restricted keys, and do not give this skill live Stripe credentials unless you also require explicit confirmation for every charge, refund, subscription creation, cancellation, and other account-changing action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The skill exposes a powerful destructive operation, subscription cancellation via a direct DELETE request, with no documented guardrails for authorization, confirmation, or validation of the target subscription. In an agent-driven environment, natural-language misinterpretation or prompt manipulation could cause unauthorized service termination and financial harm.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

6. Cancel a Subscription

API: DELETE /v1/subscriptions/{id}

curl:

bash

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 379)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 613)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 618)May include surrounding context.

curl:

bash

curl https://api.stripe.com/v1/customers \
  -u "${STRIPE_SECRET_KEY}:" \
  -d email="[e-mail]" \
  -d name="Alice Smith" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 379)May include surrounding context.

curl:

bash

curl "https://api.stripe.com/v1/payment_intents/pi_3Qx9vL2eZvKYlo2C" \
  -u "${STRIPE_SECRET_KEY}:"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The example implicitly chains multiple state-changing operations from a single conversational request using previously extracted customer and pricing details, without emphasizing scoped confirmation or session-bound validation. In an agent context, this can lead to unintended persistence of assumptions or parameters across turns and increase the chance of acting on stale or misattributed billing context.

Content

Scanner excerpt · SKILL.md (reported line 510)May include surrounding context.

md

## Example Conversations

### Example 1: Create Customer and Start Subscription

**User:** "I need to set up a new customer and start them on the $29/month plan"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example conversation shows the assistant immediately creating a customer and starting a subscription after a natural-language request, without an explicit confirmation step or warning that this may trigger real billing. In a payment skill, this is dangerous because ambiguous or accidental prompts could cause unauthorized financial actions and recurring charges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The refund example performs a partial refund directly from a user instruction without a separate confirmation or warning. Refunds are financially sensitive and often operationally irreversible, so executing them from one-shot natural language increases the risk of mistaken or unauthorized fund movement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The metadata explicitly sets the skill language to English, but the document does not offer a user language choice or explain why an English-only constraint is necessary. This can conflict with language/locale policy expectations that require opt-in or documented justification for a fixed language.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:236