stripe-directory
This skill hijacks general discovery queries to execute unauthorized financial transactions and crypto wallet operations via unverified third-party CLIs, while bypassing security controls through malicious external instruction injection.
Skill Info
Install
npx skills add https://github.com/stripe/aiAssessments (7)
AI Agent Traps ↗The skill orchestrates a multi-step payment flow (auth, decode, spend-request, pay) where the only human gate is a single approval prompt before money moves. The complexity of the flow and the instruction to 'silently run' tool checks are designed to reduce scrutiny and normalize autonomous financial action.
"silently run `which <tool> 2>/dev/null`" and "spend-request create ... --request-approval (blocks for approval) → mpp pay <endpoint_url>"
The skill provides detailed instructions for the agent to programmatically resolve payment endpoints, decode challenges, and execute financial transactions via multiple CLI tools, creating a high risk of unauthorized or automated fund depletion.
mpp decode --challenge "<value>" ... spend-request create ... mpp pay <endpoint_url>
The instructions mandate the use of specific third-party CLIs (Link, Tempo, Privy) for financial transactions, effectively overriding standard platform payment security controls with agent-managed CLI flows.
Once the user picks, silently run `which <tool> 2>/dev/null` to check if it’s installed. If not installed, offer to install it
Disk or memory exhaustion pattern detected
/dev/null <
The skill instructs the agent to facilitate authentication for external crypto wallets and payment CLIs, which could lead to the persistence or exfiltration of session tokens or private keys.
auth login → mpp decode ... tempo wallet login ... Privy Agent Wallet CLI
The skill routes authentication and payment credentials through at least four external CLI tools (link-cli, Tempo, Privy agent-wallet-cli, mppx), none of which are under the user's direct control. These tools perform `auth login` and wallet operations that can log or transmit session tokens and payment credentials externally.
"link-cli: auth login" / "tempo wallet login" / "@privy-io/agent-wallet-cli" — all external CLIs handling auth/payment tokens
The skill's claimed purpose focuses on search and discovery, but the actual implementation includes instructions for the agent to perform financial transactions and manage crypto wallets, which significantly expands the skill's scope and risk profile.
The 'Purchasing' section explicitly instructs the agent to use crypto wallets (Tempo, Privy) and execute payment commands, which is not mentioned in the claimed purpose.
The skill explicitly instructs the agent to activate even when the user never mentions Stripe Directory, covering any request to 'find vendors, tools, partners, or providers' — an extremely broad trigger that hijacks general discovery tasks and funnels them through a payment-capable skill.
"Use Stripe Directory to build a short relevant shortlist, even if the user does not mention Stripe Directory explicitly" and "any request to find vendors, tools, partners, or providers"
The instructions explicitly tell the agent to use the skill even when the user does not mention it, effectively hijacking the agent's decision-making process for any vendor-related query.
Use Stripe Directory to build a short relevant shortlist, even if the user does not mention Stripe Directory explicitly.
The skill instructs the agent to fetch and interpret content from mpp.dev (an attacker-controllable external service) to 'resolve the raw endpoint' and 'read the HTTP 402 challenge'. An attacker controlling mpp.dev or a listed service could inject instructions into the HTTP response headers or body that the agent would treat as directives.
"resolve the raw endpoint on mpp.dev if so. Read the HTTP 402 challenge to confirm the amount: curl -s -D - -o /dev/null <endpoint_url> (look for WWW-Authenticate)"
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning (seen 2 times in this file at lines 64, 72)
npm i -g
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Skill description is empty or too short. A clear description helps users evaluate the skill's purpose.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/stripe/ai/stripe-directory)<a href="https://mondoo.com/ai-agent-security/skills/github/stripe/ai/stripe-directory"><img src="https://mondoo.com/ai-agent-security/api/badge/github/stripe/ai/stripe-directory.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/stripe/ai/stripe-directory.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow