Stripe API Actions

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:20 AM UTC
• Version: 1.0.0

Overview

This Stripe skill is mostly transparent about making live billing changes, but one metadata command is too broadly scoped for authenticated Stripe writes.

Install only if you are comfortable giving the agent live Stripe write authority. Use a restricted Stripe key where possible, verify every object ID before running commands, and avoid the update_metadata command unless you have reviewed the exact Stripe path because it is not allowlisted to specific resource types.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/stripe_actions.py:208

Finding

Unrestricted Authenticated Stripe API Path in Metadata Update

Content

View full analysis

Vulnerability Details

File Location: scripts/stripe_actions.py:18-19, scripts/stripe_actions.py:116, and scripts/stripe_actions.py:208-212
Vulnerability Type: Unrestricted caller-controlled API resource path
Risk Level: Medium

Vulnerable Code

python

url = BASE + path

python

meta.add_argument("path", help="API path like /customers/cus_123 or /products/prod_123")

python

if args.cmd == "update_metadata":
    require_confirm(args)
    path = args.path if args.path.startswith("/") else f"/{args.path}"
    params = {}
    for k, v in parse_metadata(args.metadata).items():
        params[f"metadata[{k}]"] = v
    print_json(request("POST", path, params))
    return

Technical Analysis

The update_metadata command accepts a raw API path from the caller and concatenates it directly with the fixed Stripe API base URL. The implementation does not enforce the documented customer or product resource scope, validate the resource type or object identifier, normalize the path, or reject query strings, fragments, encoded path separators, traversal components, or duplicate separators.

The request remains restricted to Stripe's configured HTTPS origin, so this issue does not directly expose the secret key to an arbitrary third-party server. However, the resulting request is authenticated with STRIPE_SECRET_KEY, allowing the caller to target unintended Stripe API resources that accept metadata updates and are accessible to that key. Requiring --confirm provides a deliberate-action check but does not constrain what resource may be targeted.

Attack Path

1. An attacker, compromised agent, or mistaken operator supplies an unintended Stripe resource path to update_metadata.
2. The invocation includes --confirm, satisfying the only write-operation safeguard.
3. The script prepends the fixed Stripe API base URL without checking the resource type or identifier.

...[truncated 795 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the raw path argument with explicit resource-type and object-ID arguments.
• Allowlist only resource types intentionally supported by the skill, such as customers and products.
• Validate identifiers against the expected Stripe object prefixes and a conservative character set, such as cus_ or prod_ followed by alphanumeric characters.
• Construct the endpoint internally only after validation rather than concatenating caller-controlled paths.
• Reject query strings, fragments, .. components, encoded separators, backslashes, control characters, and duplicate slashes.
• Use a restricted Stripe key whose permissions include only the resource types and operations required by this skill.
• Display the normalized resource type and object ID before submission, especially when operating against a live Stripe account.
• Add tests confirming that unsupported resource paths and malformed identifiers are rejected before the secret key is loaded or any network request is made.

A safer interface would resemble:

python

meta.add_argument(
    "object_type",
    choices=["customers", "products"],
)
meta.add_argument("object_id")

prefixes = {
    "customers": "cus_",
    "products": "prod_",
}

expected_prefix = prefixes[args.object_type]
if not args.object_id.startswith(expected_prefix):
    raise SystemExit("Invalid Stripe object ID for selected object type")

if not args.object_id.replace("_", "").isalnum():
    raise SystemExit("Invalid characters in Stripe object ID")

path = f"/{args.object_type}/{args.object_id}"

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tainted flow: 'req' from os.environ.get (line 33, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/stripe_actions.py (reported line 35)May include surrounding context.

python

headers["Content-Type"] = "application/x-www-form-urlencoded"
    req = urllib.request.Request(url, data=data, headers=headers, method=method.upper())
    try:
        with urllib.request.urlopen(req, timeout=60) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8", errors="replace")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill enables access to environment secrets and live networked Stripe write operations, but it does not declare any explicit tool scope such as allowed tools or permissions. In a skill that can create refunds, cancel subscriptions, and modify billing state, missing scope boundaries increases the chance of unintended or unauthorized high-impact financial actions if the skill is invoked in the wrong context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/stripe_actions.py (reported line 8)May include surrounding context.

python

import urllib.parse
import urllib.request

BASE = "https://api.stripe.com/v1"


def get_key() -> str:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The update_metadata command accepts an arbitrary API path and then performs an authenticated POST with the Stripe secret key, which expands the tool's write scope beyond the declared customer/product/price/subscription-style operations. Even though it only sends metadata fields, many Stripe endpoints accept POST updates, so this generic path can modify unintended object types or future endpoints, weakening least-privilege boundaries and policy enforcement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.