quickbooks

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes explicit curl examples and headers that embed the Maton API key (Authorization: Bearer YOUR_API_KEY) and tells users to copy/paste the API key, which encourages including secret values verbatim in commands and outputs.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is an explicit QuickBooks Online integration that includes endpoints and examples for creating invoices and creating payments (POST /quickbooks/v3/company/:realmId/payment), managing payment processing/tracking, and full accounting actions via an authenticated API gateway (Maton). Those are specific financial-execution operations (creating/sending payment transactions and invoices), not generic tooling, so it grants direct financial execution authority.