dispute-refund-audit

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires a Stripe MCP connection (OAuth/restricted key) and references Stripe-specific API calls (GetMcpTools, stripe_api_search, stripe_api_details, stripe_api_read) to access disputes and refunds. These are payment-gateway integrations (Stripe) — a specific financial API rather than a generic tool — so it grants direct financial execution authority risk.