extension-stripe

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill implements Stripe checkout session creation (SKILL.md:47, 131-133) which is a direct financial operation (purchasing/charging). However, the checkout session creation function createCheckoutSession lacks any access control check (SKILL.md:131-133), unlike admin-only functions such as addProduct or setStripeConfiguration which explicitly verify admin permissions via AccessControl.hasPermission (SKILL.md:89, 117).