hydra-head-operator

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill executes Cardano layer-1 and layer-2 Hydra Head operations (init, commit, close, fanout) committing and settling blockchain funds/assets through CLI and API commands (SKILL.md:29, 139-150, 160-182). These constitute direct financial operations (transfers, commits, settlement authorization). There are no independent service-enforced access controls documented on these API routes or execution paths (protection relies entirely on optional instructions/warnings like SKILL.md:35). Therefore, high severity applies.