poster-design-studio

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates a paid hosted service (Beatra) using prepaid credits, supporting direct API calls (wallet:spend scope via bearer token and paid tool execution) as documented in SKILL.md:21-22, 114-123, and 236-239. The credential authorization is performed via an OAuth device flow (authorize.py) storing a bearer token locally, and the execution relies on local user prompts and script calls rather than an independent service-layer or execution-layer authentication/authorization check on the individual route itself (beyond holding the local credential file). Therefore, this qualifies as a direct financial operation without established independent qualifying control.