plan-input-validation

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly targets payment-gateway behavior: it references Stripe webhooks, CVE-2026-41432 (empty signing secret allowing forged credits), raw-body/constructEvent verification, idempotency for Stripe retries, and use of Stripe CLI signed webhook fixtures. Those are payment-gateway-specific controls (Stripe) rather than generic input-validation topics, so this skill is directly tied to financial execution paths and must be flagged.