ClawHub
Back to skill

Security audit

Stripe API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only helper for querying a Stripe account with a user-provided Stripe secret key.

Install this only if you intend an agent to query a live Stripe account. Use a restricted Stripe key if possible, avoid putting live keys in chat or files, and review command output because Stripe objects can include customer, payment, invoice, payout, dispute, and webhook details.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tainted flow: 'req' from os.environ.get (line 33, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/x-www-form-urlencoded"
    req = urllib.request.Request(url, data=data, headers=headers, method=method.upper())
    try:
        with urllib.request.urlopen(req, timeout=60) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8", errors="replace")
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill explicitly instructs use of an environment secret (`STRIPE_SECRET_KEY`) and live Stripe REST API access, which implies both environment-variable access and outbound network capability, but it declares no tool scope or permission boundary. That mismatch can cause an agent runtime to grant broader-than-expected access or leave reviewers without an enforceable contract about what the skill is allowed to touch, increasing the risk of secret exposure or unintended live-account queries.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.parse
import urllib.request

BASE = "https://api.stripe.com/v1"


def get_key() -> str:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
This Python code performs outbound HTTPS requests to Stripe and can retrieve potentially sensitive account, customer, charge, invoice, and webhook data, but it provides no confirmation prompt, user-facing notice, or warning comment/docstring about that data access. For code files, network calls that transmit user or system data should have some visible disclosure unless the warning is documented elsewhere or clearly covered by the skill description, which is not present in this file.

Missing User Warnings

Low
Confidence
79% confidence
Finding
The script reads a sensitive API credential from the STRIPE_SECRET_KEY environment variable and uses it for authenticated API access, but there is no user-facing disclosure beyond an error when the variable is missing. Under the code-file warning criteria, access to sensitive environment variables or credentials should include some visible explanation or documented warning unless already covered by the skill's stated description.

Static analysis

No suspicious patterns detected.