Security audit

MCP Server Development & Monetization Guide: Build, Publish, and Profit from the Tool Integration Standard

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a non-executable educational skill, but it asks for a real Stripe API key without a clear need.

Review before installing. Do not provide a production Stripe API key for this skill unless the publisher explains exactly why it is required, what actions it enables, and how to use a restricted or test-mode key. There is no evidence of malware or automatic execution in the supplied artifact, but the credential request is overbroad for the stated guide-only purpose.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill metadata declares a required STRIPE_API_KEY credential even though the file is a non-executable markdown guide and the introduction says no API key is required to get started. Requiring a real payment credential for static educational content can cause unnecessary exposure of sensitive secrets to the hosting platform or any future tooling that reads skill environment variables.

Static analysis

No suspicious patterns detected.