stripe-integration

Warn

Audited by Snyk on Mar 1, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly built around Stripe payment operations (subscriptions, one-time charges, customer management) and references payment-executing code and artifacts: src/app/actions/payment.ts, Stripe client and subscription service files, webhook events like checkout.session.completed and invoice.payment_failed, Stripe secret keys (STRIPE_SECRET_KEY=sk_test_...), and CLI commands to trigger payment events. This is a specific payment gateway integration whose primary purpose is to create/process payments and manage billing, so it grants Direct Financial Execution authority.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 1, 2026, 08:04 AM