xapi-workers

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates a CLI tool (xapi workers) that handles cloud resource provisioning, deployments, and lifecycle mutations (such as deletion, pause, and retention funds), which involve financial obligations like server-calculated retention funds and operating reserves (SKILL.md:34-36, 45). However, these operations are governed by authenticated service API credentials (XAPI_KEY, XAPI_API_KEY, or ~/.xapi/config.json) validated by the control-plane host (SKILL.md:12-14), providing independent access control enforced by the service layer.