gps-purchases

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs embedding a secret "TOKEN" directly on the command line (e.g., gps ... TOKEN), which requires the model to output the secret verbatim and therefore poses a high exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes explicit commands to perform monetary actions: create/acknowledge/consume product purchases, create/cancel/revoke subscriptions, and refund orders. Those are specific financial execution operations (purchases, subscription cancellations/revocations, refunds), not generic tooling, so this grants direct financial execution authority.