creativeclaw-generate-video

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates a video generation service ("Creative Claw") via API tool calls like generate_video, list_models, estimate_generation, and generate_image. These operations initiate generation tasks that can incur costs or charges against the user's account balance. However, the documentation notes that cost estimates require explicit user prompts ("only when the user asks about cost, balance, affordability, or sets a budget", SKILL.md:52) and mentions existing authorization checks ("existing authorization", SKILL.md:14), but does not detail an independent, execution-layer authentication or authorization mechanism enforced for the direct payment/generation route itself (only mentioning user-facing instructions and connector connection steps). Because it handles direct generation operations without a documented independent service-side control gating the financial action, it falls under high severity.