active-subscriptions-audit

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly built around Stripe ("Stripe MCP") and prescribes Stripe-specific calls (GetMcpTools with server "user-Stripe", stripe_api_search / stripe_api_details / stripe_api_read, and an example stripe_api_read GetSubscriptions). This is a dedicated payment-gateway integration (requires OAuth or restricted keys and handles secret keys), so it constitutes a Stripe payment API capability and thus direct financial execution authority (even if the shown endpoints are read-oriented, the skill is explicitly designed to operate against a payment gateway API).