refunds-and-disputes

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents issuing direct refunds via the Dodo Payments API (client.refunds.create) which executes a direct financial operation (transfer/charge reversal). Access control relies on API credentials (bearer token and environment settings instantiated in the DodoPayments client), but lacks independent validation enforced by the service layer outside the agent's provided credentials. Therefore, it is a direct operation without qualifying independent control, making it High severity.