rc-forge

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for RevenueCat monetization: it requires a V2 secret (RC_API_KEY / RC_KEY_FILE) with read/write project access and documents Bearer V2 auth. It provides and documents concrete operations that modify monetization state (create-product, attach-products-to-entitlement/package, bootstrap_catalog.py) and paywall publishing (publish_paywall.py, publish-paywall/MCP publish-paywall, and related PATCH/save_draft → actions/publish). Those are specific, non-generic APIs/tools that change billing/catalog/paywall configuration and can enable or modify revenue flows, so this is direct financial execution authority.