referral-programs

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill's description says it "designs and runs" referral and affiliate programs, including "payout reconciliation," and rule 8 states that "payouts go out only within what the user has authorized." That documents a route in which the skill initiates reward and commission payouts, which are direct transfers of money. Most of the file is design guidance, so the operational reading rests on these two statements, and the linked AFFILIATES.md and PROGRAM-DESIGN.md were not supplied to confirm how payouts are executed. The only gate on the payout route is "within what the user has authorized," which is an agent-followed instruction. No service authentication, authorization or independent approval mechanism for the payout route is documented, so the direct-operation control test fails and the severity is high.