nws-active-alerts

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly implements a paid API flow that requires the agent/client to hold and use a crypto wallet private key (FITTINGS_PRIVATE_KEY) to sign an authorization and spend USDC on Base. It describes receiving a 402 signed quote, signing an authorization, and a facilitator settling the payment; shows an export of a private key and warns about on‑device plaintext keys and spending caps. Because it requires and uses a crypto wallet signing flow to authorize payments, this is a direct financial execution capability.