distribb

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents operational endpoints and agent tools for running paid ads (Meta, Google, TikTok, LinkedIn) and managing bank accounts and integrations via POST /agent-tools/call and /paid-ads. These represent direct financial operations (charges, ad spend, and financial instruction routing). However, qualifying independent access control is documented for these routes: execution relies on server-side validation of connected ad/bank accounts, API keys (DISTRIBB_API_KEY), and explicit pre-approval protocols or preview modes where the user approves spend/actions before execution (e.g., lines 59, 145, 1070: "preview first, the user approves every spend", "approved changes in action mode with confirm"). This places the direct financial exposure at the Medium tier.