Saas Billing System

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:05 AM UTC
• Version: 1.0.0

Overview

This billing skill is only documentation, but it asks users to run missing billing commands and pass a Stripe key in a risky way.

Review this carefully before installing or using it for a real Stripe account. Treat it as incomplete documentation rather than a working billing system, avoid passing API keys on command lines, use restricted test-mode keys first, and require an inspectable implementation before connecting production billing data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:23

Finding

Stripe API Key Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-24
Vulnerability Type: Secret exposure through process arguments
Risk Level: Medium

bash

# Setup Stripe
./billing.sh stripe --key $STRIPE_KEY

Technical Analysis

The documented command expands the STRIPE_KEY environment variable and passes its value to billing.sh as a command-line argument. Secrets supplied this way may become visible in process listings, shell debugging output, audit records, monitoring telemetry, wrapper logs, crash reports, or command histories where the expanded command is recorded.

The referenced billing.sh file is not included in the audited project, so its handling of the key cannot be assessed. Nevertheless, the documented invocation pattern itself encourages insecure secret handling.

Attack Path

1. A user stores a valid Stripe API key in the STRIPE_KEY environment variable.
2. The user follows the documented setup command.
3. The shell expands $STRIPE_KEY, placing the plaintext credential in the new process's argument vector.
4. A local user or monitoring component capable of observing process arguments or related telemetry captures the key while the command runs or from retained logs.
5. The captured key is used against Stripe APIs within the permissions assigned to that key.

Exploitation requires access to process metadata, command telemetry, logs, or another location where the expanded argument is retained.

Impact Assessment

Disclosure may permit unauthorized Stripe API operations up to the privileges of the exposed key. Depending on whether the key is restricted or unrestricted, potential effects include access to billing and customer records, modification of subscriptions or invoices, creation of refunds, and other payment-account operations. This finding does not itself provide system privilege escalation, and the exact impact depends on the key's Stripe permissions.

Remediation

View remediation

Remediation Suggestions

• Do not pass Stripe credentials through command-line flags.
• Update the interface so billing.sh reads the credential directly from a protected environment variable without reproducing it in the argument vector, or accepts it through standard input with terminal echo disabled.
• Prefer a dedicated secret manager or operating-system credential store for production deployments.
• Use restricted Stripe API keys with only the permissions required by the billing workflow.
• Ensure logs, diagnostics, errors, and telemetry redact credentials.
• Avoid shell tracing such as set -x while handling secrets.
• Rotate any key that may already have been exposed through this command pattern.
• Add the referenced implementation to the package and subject its credential storage, logging, file permissions, and API authorization behavior to a separate security review.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep