provider-api

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes a raw provider API escape hatch (provider-api-request) that injects configured credentials server-side and permits arbitrary provider methods/paths. The docs include an explicit Stripe example (provider: "stripe", path: "/charges") and guidance about making write/delete requests, meaning the agent can call payment gateway endpoints (create charges, refunds, etc.) using stored credentials. This gives the agent direct financial execution capability against payment providers.