uah-mono-payouts

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires the agent to read and then present exact sensitive payment details verbatim (card numbers, IBANs, deposit addresses/comments and to embed them in payout JSON/tool calls), which forces secret/PII values into the agent's outputs and creates an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly and narrowly designed to execute crypto-to-fiat payouts. It defines operations for USDT on BEP20, constructs payout objects containing bank/card/IBAN details, calls specific MCP APIs such as quote_uah_payout, create_uah_payout_order, render_payment_instructions, and check_usdt_bep20_balance, returns approval/payment URLs, generates exact on-chain payment instructions (amount, network, address, memo), and polls order/payment status. These are concrete financial execution actions (creating payout orders, providing deposit addresses and exact amounts, monitoring deposits), not generic tooling. Therefore it grants direct financial execution capability.