use-user-controlled-wallets

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates non-custodial user-controlled wallets using Circle's SDKs to perform token transfers, message signing, and smart contract execution (SKILL.md:3, SKILL.md:143-147). These actions constitute direct financial operations (transfers, purchases, trades). Regarding controls, all sensitive operations require end-user authorization through a challenge-response model and hosted UI (PIN, email OTP, or social login) via the @circle-fin/w3s-pw-web-sdk (SKILL.md:8, SKILL.md:84, SKILL.md:105-112). This represents qualifying independent access control enforced by the service layer (Circle's authenticated challenge execution).