billing-sdk

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs running npx commands (e.g., "npx @billingsdk/cli init") which fetch and execute remote package code at runtime, and the package's repository is referenced as https://github.com/dodopayments/billingsdk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates with a payment provider (Dodo Payments) and includes server-side API code that creates checkout sessions and customer portal sessions (dodo.checkoutSessions.create, dodo.customers.createPortalSession). It also references a DODO_PAYMENTS_API_KEY environment variable. These are specific payment gateway operations that enable moving money (creating checkout/payment sessions), so this grants direct financial execution capability.