Stripe

This skill appears to do what it says (run SQL against a Stripe replica), but several red flags mean you should be cautious before installing or using it: - Confirm the provisioning site (paymentsdb.com) and the PGHOST are trustworthy before connecting. If you do not control that service, treat it as an external third party that will see queries and possibly metadata. - Do NOT store production credentials in plaintext inside query.sh or in the repository. Prefer a short‑lived, least‑privilege read‑only DB user and provide credentials via a secure secret store or environment variables (and update the script to read them from env vars), then rotate them after use. - Understand that the skill executes arbitrary SQL you pass it — an attacker or misconfiguration could run wide queries and exfiltrate sensitive fields (API key hashes, emails, billing info). Limit queries, use row/column ACLs in the DB, and test with a minimal dataset. - The skill metadata should declare required binaries (psql) and required credentials; the absence of these declarations is an incoherence you should ask the publisher to fix before trusting the skill. If you cannot validate the external host and provisioning service or cannot run this against a controlled, read‑only replica, avoid installing/using the skill.