cash-flow-variance-check-free

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (critical risk: 1.00). The skill instructs users to install an external payment and onboarding package via npx -y @alipay/agent-payment@latest install, which downloads and executes arbitrary third-party code from an untrusted external source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill contains instructions for the AI assistant to fetch and execute an external installation command (npx -y @alipay/agent-payment@latest install) from an arbitrary third-party/unofficial source during runtime, which constitutes an unverifiable runtime external dependency under weak/unknown provenance.