openfin-onramp

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill implements a fiat-to-crypto onramp operation (POST /agent/onramp and MCP action get_onramp_url) routing through Moonpay and Onramp.money to purchase cryptocurrencies via cards, Apple Pay, Google Pay, UPI, IMPS, and bank transfers. This constitutes a direct financial purchase/settlement flow. However, the documentation notes that the user completes payment and KYC in the provider's external UI (SKILL.md:21-22), and no qualifying independent access-control mechanism (such as authenticated service API credentials or an enforced login check) is documented as protecting these payment-routing endpoints. Therefore, it qualifies as a direct financial operation without established qualifying control.