sesion-mental-health-saas

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub URL points to a third‑party repository (unknown/individual account) being used as a direct clone source which can host unreviewed or malicious code, while the other two URLs (localhost and the vendor site ara.so) are benign in this context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates payment gateways and billing APIs: the architecture lists "Stripe + MercadoPago" (payment processors), the environment variables include STRIPE_SECRET_KEY and MERCADOPAGO_ACCESS_TOKEN (credentials), and the invoice/notification flow references Mercado Pago as a payment option and implements AFIP electronic invoice creation. These are specific, finance-related integrations (payment gateways and electronic billing), which constitute direct financial execution capability.