abacatepay

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to paste their API token and instructs running a command that embeds the pasted token as a command-line argument (ruby ... save_token.rb 'PASTED_TOKEN'), which requires the LLM to receive and output the secret verbatim, creating an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payment integration for "AbacatePay" and includes concrete, purpose-built scripts and REST API interactions to create charges (create_billing.rb / PIX/CARD), generate PIX QR codes, simulate/check PIX payments, create coupons, and — critically — create withdrawals to PIX keys (create_withdrawal.rb) and access store balance/revenue. It requires a Bearer API token and targets the payment API base URL. These are not generic helpers: they are specific financial operations (payment creation and initiating withdrawals/payouts). Therefore it grants Direct Financial Execution Authority.