tripo-studio

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill drives the Tripo Studio web app via browser automation (Claude in Chrome or built-in browser) to run 3D asset generations that spend user credits (e.g., via T.generate(cost)). This constitutes an operating financial/credit-spending task (direct purchase/service usage instruction). However, the execution layer relies entirely on the user's signed-in browser session and browser security context, with explicit instructions for the agent to check the UI state and wait for user confirmation before spending. Per the evaluation guidelines, browsing/driving an authenticated web application constitutes independent service-level authentication gating the action (access control).