ai-image-generation-studio

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates a paid API service (Beatra) that performs direct purchases/charges against prepaid credits and wallet spend using stored bearer tokens (carrying wallet:spend scope). While authorization relies on an OAuth device flow storing a token, the documentation notes that the tool calls themselves execute API requests against mcp.beatra.ai using the stored credential without a separate transactional MFA or independent execution-layer access check per call beyond holding the token (human confirmation is instructed via prompt guidance rather than enforced by an independent server-side validation gating the route itself). Thus, direct financial operations are present without established independent qualifying control.