checkout-components
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly designed for payment processing with Stripe: it includes Stripe Elements UI components, environment variables for STRIPE_SECRET_KEY, server-side examples that call stripe.paymentIntents.create, payment method saving, subscription management (cancel/upgrade), and webhook/secret handling. These are specific payment gateway integrations (Stripe) intended to create/confirm payments and manage subscriptions—i.e., capabilities to execute financial transactions, not generic tooling. Therefore it grants direct financial execution authority.
Audit Metadata