moyasar

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs frontends to load and execute third-party code at runtime from the jsDelivr CDN (https://cdn.jsdelivr.net/npm/moyasar-payment-form@2.2.9/dist/moyasar.umd.min.js and its CSS URL), which is a required runtime dependency for the hosted Moyasar Form and therefore executes remote code in clients — creating a supply-chain/runtime execution risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payment gateway integration for Moyasar and defines REST operations to create/capture/void/refund payments, create invoices, manage payouts and payout accounts, settlements, and card tokens. It references API keys (pk_/sk_ prefixes), secret-key usage, and endpoint-level flows for performing charges, refunds, captures, and sending money out (payouts). These are specific financial execution functions (payment gateway, refunds, payouts), not generic tooling, so it grants direct financial execution capability.