z-ts-telegram-mini-app

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill outlines client-side integration for Telegram Stars payments via @tma.js/sdk's invoice.openUrl() or window.Telegram.WebApp.openInvoice() (SKILL.md:167-194). This constitutes a direct payment/purchase operation. However, the skill explicitly notes that invoice links are created and settled server-side, and client-side status is merely an observed hint rather than a direct payment authorization (SKILL.md:167-194, 229-231). The execution layer's actual payment processing and access control depend entirely on Telegram's Bot API and the documented server-side validation/authorization layer (SKILL.md:8-10, 36, 169, 250-251), which acts as an independent service-layer check.