ai-photo-restyler

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates a paid hosted service (Beatra) using prepaid credits and API calls (such as paid image generation/restyling), representing a direct financial purchase/charge operation. Although it requires human approval per call and uses an OAuth bearer token (wallet:spend scope) obtained via browser sign-in, there is no service-enforced independent access control on the agent's payment execution route (it relies on agent-followed warnings and confirmation instructions rather than server-side secondary authentication gating transactions independently of the agent). Therefore, it falls under direct financial operations without qualifying independent controls.