asset-gen

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates paid image, video, and 3D generation APIs (Gemini, xAI Grok, and Tripo CLI) that cost real money and consume service credits. This constitutes direct financial purchases/charges. The documentation instructs the agent to invoke CLI commands and scripts using API keys (ASSET_GEN_SKILL_DIR/tools/asset_gen.py, tripo CLI), but there is no independent access control or authentication check enforced by the execution layer for these routes; authentication relies on API keys supplied in the environment or agent configuration.