pagetranslate-book-translator

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). Operation: the skill buys a translation job, which is a direct purchase. When the price is 0.00 because the account's word balance covers it, the agent calls start_translation, which debits the account's credits (SKILL.md:60). The Kindle/curl section also starts the job from the balance with POST /jobs/JOB_ID/translate (SKILL.md:79-82). This is a purchase the agent initiates, not an incidental service call, so the service-cost exclusion does not apply. The card path (payment_url) is performed by the user in the browser, and the agent never pays or enters card details (SKILL.md:58-59, 121). That path alone would not make the skill a direct operation, but the balance-debit route does.

Control: the balance-debit route is gated by the PageTranslate API key, sent as a Bearer token on every request (SKILL.md:70, 76-77, 79-82). The service validates that credential against the account, and an account word balance can only be spent through an authenticated account. Under the rule, validated service API credentials count as qualifying access control, even though the key is reusable or may be exposed and the agent is the one submitting it. No agent-followed confirmation is relied on for this check. Because a direct operation has qualifying independent control, the tier is Medium, not High.

Recall-first note: the agent-side "get a yes" step (SKILL.md:57) is an instruction-only check and is not counted as control. The Medium answer rests only on the service-enforced key check.