payment-integration
Warn
Audited by Snyk on Feb 17, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly and specifically designed for payment processing and integrates payment gateways (Stripe, LemonSqueezy, Paddle). It contains concrete API calls and implementations that perform financial actions: creating checkout sessions (stripe.checkout.sessions.create, LemonSqueezy createCheckout), creating subscriptions, updating and canceling subscriptions (stripe.subscriptions.update/cancel), handling payment webhooks that record and act on payment events, plus environment variables for secret API keys. These are direct payment gateway operations (i.e., tools to send transactions/manage subscriptions), therefore it provides Direct Financial Execution capabilities.
Audit Metadata