rpgjs-studio

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates an HTTP API client to manage RPGJS Studio content, which includes AI-generated media and map generation features that debit metered API-key credits (e.g. SKILL.md:16, SKILL.md:22: "Media generation debits metered API-key credits on execute before enqueueing..."). This represents a direct financial operation (managing and executing paid metered service credits/usage purchases). However, these direct financial/credit-debit operations require authentication via the x-api-key header sourced from the RPGSTUDIO_API_KEY environment variable (SKILL.md:52, SKILL.md:62), and the documentation explicitly enforces validation against authentication errors (SKILL.md:67: "Fail fast on authentication errors. If the API returns an invalid-key style response, 401, or 403, stop the task and tell the user to verify the key or contact support."). This constitutes qualifying independent access control enforced by the service API layer.