creating-replay-vision-scanners

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill's documented operations include creating, scheduling, and updating paid Replay Vision scanners and backfills via API calls (vision-scanners-create, vision-scanners-backfills-create, etc.) that spend real credits (1 credit = $0.01) against an organization's budget. This constitutes a direct financial operation (charges/purchases/usage settlement authorization). There is no documented independent access control or authentication enforced by the execution layer for these routes; the skill relies entirely on agent-driven estimation, conversation, and user confirmation steps ("Confirmation here is a conversation step, not an API capability"). Therefore, it qualifies as high severity.