Skill Stripe Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.0.2

Overview

This Stripe monitoring skill is mostly purpose-aligned, but it asks users to handle highly sensitive Stripe access in ways that are broader and less controlled than a read-only monitor needs.

Review before installing. Use only a restricted read-only Stripe key, avoid putting a full live secret key in the agent environment or config, and do not enable Telegram summaries, automatic alerts, or webhooks unless the destination is private and you are comfortable sending sensitive revenue and customer-related details there.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:42

Finding

Full-Privilege Stripe Secret Key Is Encouraged for Read-Only Functionality

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:97

Finding

Stripe Secret Is Exposed Through Curl Process Arguments

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:253

Finding

Sensitive Stripe Information May Be Forwarded to Telegram Without Data Minimization

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (30)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly suggests sending a daily Stripe summary to Telegram, which transmits sensitive business data such as revenue, failed payments, and subscription activity to a third-party messaging platform. Without a prominent warning, scope limitation, or guidance to redact sensitive fields, operators may unknowingly expose financial and customer-related data outside Stripe and the local agent environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README states the skill 'reacts immediately (without being asked)' to events like failed payments, new subscriptions, and cancellations. That kind of broad autonomous triggering can cause unintended invocation and unsolicited disclosure of sensitive Stripe events into agent conversations or connected notification channels, especially if the runtime context is shared or loosely scoped.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation contradicts itself by calling the skill read-only while recommending use of a full-access secret key. This creates a privilege mismatch: the operational behavior may be read-only today, but exposure of the credential or abuse by adjacent components would enable write actions in Stripe.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly described as read-only, yet it tells users that a full-access Stripe secret key is acceptable. If the skill, surrounding agent, or any future modification misuses that key, it could perform destructive or financial actions well beyond monitoring, violating least-privilege and increasing blast radius.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill encourages scheduled delivery of revenue summaries to Telegram without warning that business metrics, customer/payment context, and account status may be transmitted to a third-party messaging platform. This can cause unintended data disclosure, especially if chat recipients, bot configuration, or message retention are not tightly controlled.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation states the skill is read-only, yet later sections describe webhook handling and sending summaries/alerts to Telegram. That mismatch can mislead users about the skill's real behavior and risk profile, causing them to approve or deploy it without understanding that it can transmit business data externally and rely on a public endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 103)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 113)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 137)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 164)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 175)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 185)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 200)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 213)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 282)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 308)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

All Stripe API calls use HTTP Basic auth — key as username, empty password:

bash

curl -s -u "$STRIPE_KEY:" "https://api.stripe.com/v1/..."

Get MRR

Static analysis

No suspicious patterns detected.