xapi

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents direct financial payment and top-up operations via npx xapi-to topup --method stripe --amount 10 (SKILL.md:304) and npx xapi-to topup --method x402 (SKILL.md:305), as well as domain purchases (SKILL.md:3, SKILL.md:350). These direct financial/purchase operations rely entirely on API keys configured locally (XAPI_KEY or ~/.xapi/config.json) without independent external service-layer authentication or transaction validation checks for the payment execution route itself. Therefore, it is a direct operation without qualifying independent access control.