Stripe Full Read Access

Access Stripe directly with a Stripe secret or restricted API key for broad read-only platform queries, especially Connect accounts, application fees, balanc...

This skill appears to do what it says (read Stripe data), but it has some red flags you should address before installing or running it: - The SKILL.md expects a Stripe API key at /home/clawd/.config/stripe/api_key and uses STRIPE_API_KEY, but the skill metadata does not declare any required credential or primaryEnv. Confirm where your agent will look for keys and whether that hardcoded path is appropriate for your environment. - The SKILL.md recommends using a platform-level key for Connect reporting. Platform keys are highly sensitive—prefer creating and using a restricted, read-only key scoped only to the endpoints you need. - Because the skill instructs the agent to read a local file, ensure the agent process has explicit permission to access that path and that no unintended keys reside there. If you run agents in multi-tenant or cloud environments, do not place secrets in predictable filesystem locations. - Consider updating the skill or configuration to: declare the expected credential in metadata (primaryEnv or requires.env), make the key path configurable (not hardcoded to /home/clawd/...), and document the minimal OAuth/Restricted key scopes required. If you cannot confirm these items, treat the skill as higher-risk and avoid granting it access to any production/privileged Stripe keys.

Type: OpenClaw Skill Name: stripe-full-read-access Version: 1.0.0 The skill provides a set of instructions and code snippets for an AI agent to perform read-only financial reporting and analytics using the Stripe API. It correctly identifies a local configuration path (/home/clawd/.config/stripe/api_key) for authentication and uses standard tools like curl and Python's urllib to interact with official Stripe endpoints (api.stripe.com). There is no evidence of data exfiltration, credential theft, or malicious execution.