use-circle-cli

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill provides an AI agent CLI interface for managing stablecoin wallets, cross-chain bridging, smart contract execution, and executing paid API requests (circle wallet transfer, circle wallet execute, circle bridge transfer, circle services pay). These are direct financial operations (transfers, purchases, settlement authorization). Regarding access control, the CLI uses email + OTP authentication (circle wallet login) and requires user consent for terms and policy limits, but allows automated agent execution of wallet transactions once authenticated and operating via the CLI. However, since it performs direct financial operations (transfers/payments) without continuous independent authorization (such as runtime execution-layer transaction signing per action outside the CLI session), it falls under high severity due to direct financial actions performed by the agent without independent multi-factor approval per transaction.