send-doughnuts
Send a box of Krispy Kreme donuts (doughnuts) to someone by mail, paid with your own credit card via Stripe Link — driven entirely from the terminal. Use when the user wants to send donuts, doughnuts, treats, or a thank-you gift to a lead, prospect, customer, colleague, or friend — e.g. "send don...
Install this skill
or
88/100
Security score
The send-doughnuts skill was audited on Aug 17, 2026 and we found 4 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
low line 82
Command substitution pattern
SourceSKILL.md
| 80 | |
| 81 | ```bash |
| 82 | link-cli mpp decode --challenge "$(grep -i '^www-authenticate:.*method=\"stripe\"' headers.txt | sed 's/^[Ww][Ww][Ww]-[Aa]uthenticate: //')" |
| 83 | ``` |
| 84 |
low line 112
Command substitution pattern
SourceSKILL.md
| 110 | --spend-request-id "<lsrq_…>" \ |
| 111 | --method POST \ |
| 112 | --data "$(cat order.json)" |
| 113 | ``` |
| 114 |
medium line 74
Curl to non-GitHub URL
SourceSKILL.md
| 72 | |
| 73 | ```bash |
| 74 | curl -s -D headers.txt -o body.json -X POST https://api.zinc.com/agent/orders \ |
| 75 | -H "Content-Type: application/json" --data @order.json |
| 76 | grep -i '^www-authenticate:.*method="stripe"' headers.txt |
medium line 122
Curl to non-GitHub URL
SourceSKILL.md
| 120 | |
| 121 | ```bash |
| 122 | curl -s https://api.zinc.com/orders/<order_id> -H "Authorization: Bearer <X-Api-Key>" |
| 123 | ``` |
| 124 |
Scanned on Aug 17, 2026
View Security Dashboard