alpaca-broker-funding-transfers

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent at runtime to fetch live Alpaca documentation (e.g., https://docs.alpaca.markets/llms.txt and https://docs.alpaca.markets/llms-full.txt and/or the alpaca-docs MCP) to obtain endpoint schemas that directly influence generated prompts/instructions, so external content can control the agent's behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documents Alpaca Broker funding and transfer APIs that explicitly create and manage money movements: endpoints to create transfers (ACH and wire), funding-wallet withdrawals, and to add/manage recipient banks/ACH relationships (including Plaid tokens, bank_id/relationship_id, fee handling, directions). These are concrete payment/transfer operations (send/withdraw funds, manage banking rails), so the skill grants direct financial execution capability.