duffel

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill implements direct financial operations, specifically flight bookings and payments via Stripe Link and Duffel CLI (duffel book) as documented in SKILL.md:87-87 and SKILL.md:448-457. However, these direct payment operations rely solely on the agent following instructions and optional human confirmation prompts ("Exactly one HITL: native book, airline browser checkout, or cancellation" at SKILL.md:529-530), with no independent access control or service-enforced cryptographic/hardware signing layer for the payment route itself.