hunt-business-logic

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly focused on business-logic vulnerabilities that target payment and wallet flows. It contains concrete, targeted examples and API-level patterns for payment/checkout manipulation, wallet transfers (e.g., transferBalance()/YPTWallet transfer), coupon redemption and refund manipulation, and references to Stripe-specific behavior. It even includes HTTP and script examples to invoke transfer/coupon/refund endpoints and race-execution techniques against them. These are specific financial-operation APIs/patterns (wallet transfers, payment/checkout flows, Stripe trial handling), not just generic tooling, so it grants direct financial-execution capability.