duffel

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill implements direct financial operations, specifically flight bookings and purchases using Duffel CLI (duffel book) and Stripe Link integration (SKILL.md:467-471), which execute real payments and charges. For access control, the execution layer relies on an independent service-level authentication mechanism: Stripe Link account integration and Duffel API credentials/payment methods (stripe-link payment-methods list, --payment-method-id pm_…) enforced by the underlying payment platform and CLI service layer, rather than agent-implemented checks.