comfy

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents operations for executing workflows and partner-API calls (comfy run, comfy generate) that can spend user cloud credits (financial-security exposure: direct operation). These commands require interactive TTY confirmation or an explicit flag (--allow-spend / --yes) to bypass a fail-closed spend gate, but lack independent access control enforced by the service or execution layer (access gating relies on the CLI/agent submitting a flag or interactive approval). This constitutes a direct financial operation without qualifying independent control.