mercadopago

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). It asks the user to paste their MercadoPago access token into the conversation and then instructs running save_token.rb with the token as a quoted command-line argument, which requires the LLM to receive and embed the secret verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a MercadoPago payment integration (a payment gateway). It provides scripted, authenticated API actions to create payments, issue refunds, manage customers, and check account balance (create_payment.rb, refund.rb, payments.rb, customers.rb, account_balance.rb). It requires an access token and includes example API payloads for creating transactions and refunding by payment ID. These are specific, primary functions to move and manage money via a payment processor, so it meets the "Direct Financial Execution" criteria.