pagetranslate-scanned-pdf-translator

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). Financial operation: the skill starts paid translation jobs. After the user approves the quoted price, the agent calls start_translation when the price is 0.00 (covered by the account's word balance), and the curl path posts to /jobs/JOB_ID/translate to start from that balance. This debits prepaid funds, so it is a direct purchase/debit, not just a service-cost hint. The card-payment route is handed to the user to complete in the browser, and the agent is told not to pay or enter card details, so that route is not an agent payment. Direct operation, control evidence: every request carries Authorization: Bearer $PAGETRANSLATE_API_KEY, and the service validates that key against the account before the balance is debited. The API key is a service-validated credential that gates this route, which meets the qualifying-control standard. The agent is not the enforcer, and the skill does not rely only on agent-followed confirmation. Because a qualifying control is established, the result is medium rather than high. Medium also applies if the operation were treated as indirect.