engineering-skills

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The file instructs running "npx agent-skills-cli add alirezarezvani/claude-skills/engineering-team", which pulls and executes remote npm package code and installs the remote skill repository "alirezarezvani/claude-skills/engineering-team" that can supply prompts and/or executable content at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL.md explicitly lists a "Stripe Integration" skill (payment integration, webhooks) and also references Stripe in the top-line description. Stripe is a payment gateway — a specific tool for handling payments/transactions — so this package includes a skill specifically designed for financial execution/integration.