T09 · Insecure Skill Coding Practices
Error
- Location
payments.md:44- Finding
State-Changing Stripe API Examples Omit Idempotency Keys
- Content
View full analysis
- Remediation
View remediation
Security audit
Stripe API Integration
Security checks for vulnerabilities and agentic risk
Overview
This Stripe skill is not clearly malicious, but it should be reviewed because it can guide live financial changes and automatically save Stripe-related business data across sessions.
Review before installing if you do not want a skill to persist Stripe contacts, account references, device/network details, incidents, disputes, or fee history without asking first. Use test mode by default, require explicit confirmation for live writes, and add idempotency keys to any state-changing Stripe POST before execution.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:41- Finding
Automatic Cross-Session Persistence Collects Excessive Personal and Operational Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
webhooks.md:143- Finding
Go Webhook Example Permits Memory Exhaustion Through an Unbounded Request Body
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (188)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Account Context acct_1AbC…, Irish entity, live since 2024, EUR payout, sells B2B SaaS in EU + US. Dashboard owner: Marta (see contacts). Keys: `keychain:stripe-live`, `env:STRIPE_WEBHOOK_SECRET`. ## Integration Shape Node + Stripe SDK, API version pinned 2025-04-30. Checkout Session (subscription mode) for signup,
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The refund, dispute, and payout examples perform financially sensitive and sometimes irreversible actions without an explicit execution warning. In the Stripe context this is more dangerous than generic API examples because refunds, dispute acceptance, evidence submission, and payouts can directly cause financial loss, waive contest rights, or transfer funds from a live account.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 90% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md 2. **Signature verification**: a bad signature returns 4xx, and the handler never runs. Verify against raw bytes. 3. **Declines**: each `decline_code` your retry logic branches on produces the branch you expect (`dunning.md`). 4. **Authentication required**: an off-session charge that needs 3DS produces the recovery path, not a retry loop (`sca-3ds.md`). 5. **Out-of-order and late events**: a subscription update arriving after the invoice it precedes must not corrupt state. 6. **Renewals, trial ends and retries**: with a test clock, below. 7. **Proration**: the preview matches the invoice you assert against, for both upgrade and downgrade. 8. **Refunds, partial refunds and credit notes**, including their tax effect.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Create Cardholder
bash curl https://api.stripe.com/v1/issuing/cardholders \ -u "$STRIPE_SECRET_KEY:" \ -d "name=Jenny Rosen" \ -d "email=jenny@example.com" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The Financial Connections example requests sensitive bank-data scopes (
balancesandtransactions) without an inline warning or consent-minimization guidance at the point of use. In a skill intended to guide implementation, this can normalize overbroad data access and lead integrators to collect more financial data than necessary, increasing privacy, regulatory, and breach impact.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
1. Create Checkout Session
bash curl https://api.stripe.com/v1/checkout/sessions \ -u "$STRIPE_SECRET_KEY:" \ -d "mode=subscription" \ -d "customer=cus_XXX" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The recovery guidance encourages using expired-session email data for follow-up emails without mentioning consent, privacy notice, retention limits, or compliance requirements. In a payments context this can lead to improper secondary use of personal data and regulatory or trust risks, especially across jurisdictions with strict marketing and privacy rules.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file directs the agent to write integration shape, catalog data, and conversion decisions into local memory and artifact files. This adds persistent local file-write behavior beyond the core Stripe integration purpose, which can leak business data, create integrity issues in shared state, or be abused for unauthorized persistence if the agent follows these instructions broadly.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Express Account
bash curl https://api.stripe.com/v1/accounts \ -u "$STRIPE_SECRET_KEY:" \ -d "type=express" \ -d "country=US" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation presents a live account-deletion command with no warning, confirmation requirements, or explanation of irreversibility. In an operational support skill, that increases the chance an agent or user executes a destructive action against the wrong connected account, causing service disruption, loss of onboarding state, or compliance and payout issues.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Split Payment (Multiple Sellers)
bash # Pay to platform, then transfer to multiple accounts curl https://api.stripe.com/v1/payment_intents \ -u "$STRIPE_SECRET_KEY:" \ -d "amount=10000" \ -d "currency=usd"
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The same instruction block also tells the agent to log seller-loss incidents in a separate incident file. While less sensitive than direct PII replication, it still pushes financial-loss events into an external tracking system outside the stated Stripe integration scope, which can create unnecessary financial profiling and broaden the blast radius of sensitive operational data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The same instruction block also tells the agent to log seller-loss incidents in a separate incident file. While less sensitive than direct PII replication, it still pushes financial-loss events into an external tracking system outside the stated Stripe integration scope, which can create unnecessary financial profiling and broaden the blast radius of sensitive operational data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file provides ready-to-run curl commands for customer, product, price, coupon, and promotion-code operations, including update and delete actions, but it does not include a clear user warning about the impact on production billing data or customer records. While some sections describe Stripe behavior, they do not function as an explicit safety warning before destructive or account-affecting actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List Customers
bash curl "https://api.stripe.com/v1/customers?limit=10&email=customer@example.com" \ -u "$STRIPE_SECRET_KEY:"
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- memory-template.md:62