abm-diy-campaign

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx @vibeprospecting/vpai@latest at runtime (e.g., "npx @vibeprospecting/vpai@latest config --api-key "YOUR_VIBE_API_KEY"" and "npx @vibeprospecting/vpai@latest autocomplete ") which downloads and executes remote npm package code as a required runtime dependency for Phases 1–2, so it fetches and runs remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly uses the LinkedIn Ads API (mentions LinkedIn Ads API credentials and includes a curl call to LinkedIn endpoints) and instructs creating and launching campaigns with "Set budget, schedule, and bid strategy" and "Launch" — i.e., it is designed to create live ad campaigns and manage ad spend. This is a specific capability to execute/modify advertising budgets (direct financial execution for ad spend).