setup-payments

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates payment-related tools via the Kelviq MCP (kelviq:checkout_create_session, kelviq:subscription_create, kelviq:subscription_update) to charge customers, set up checkouts, and manage subscriptions. These represent direct financial operations (charges and subscription management). Access control relies on API key authentication (KELVIQ_SERVER_API_KEY), which constitutes a qualifying independent access control mechanism for the service layer. Therefore, the security exposure is medium.