z-go-telegram-bot

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill implements direct financial operations via Telegram Stars (createInvoiceLink, answerPreCheckoutQuery, and RefundStarPayment), which handle charging, approving pre-checkout queries, and refunding payments. Authentication and authorization rely on Telegram bot tokens passed in HTTP request headers/URLs (https://api.telegram.org/bot<token>/<method>), but the skill does not establish an independent service-enforced access control or validation mechanism on the payment execution path itself.