moyasar

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs including and running the hosted Moyasar Form JS from the CDN (https://cdn.jsdelivr.net/npm/moyasar-payment-form@2.2.9/dist/moyasar.umd.min.js), which is fetched at client runtime, executes remote code to render/control the payment form, and is a required dependency for the hosted-form flow.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a specific payment-gateway integration (Moyasar) exposing explicit payment operations: create/capture/void/refund payments, manage invoices, payouts and payout accounts, settlements, and card tokens via Moyasar's REST API and keys. These are direct financial execution functions (payment gateway, refunds, payouts), not generic tooling. Therefore it grants direct financial execution authority.