building-with-fintoc

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to "Always fetch the relevant doc before answering" and references docs hosted at https://docs.fintoc.com (e.g. https://docs.fintoc.com/llms.txt and various https://docs.fintoc.com/*.md links), so content from docs.fintoc.com is fetched at runtime and can directly control the agent's prompts/responses.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly documents financial execution products and APIs: "Payments" (one-time and recurring bank payments), "Transfers" (programmatic payins/payouts, SPEI/CLABEs, Business Accounts), and "Direct Debit" (recurring charges via PAC). It also lists the Fintoc API MCP (mcp.fintoc.com) as the tool for "AI agent making API calls." These are specific, purpose-built mechanisms to move money (payment gateways/bank transfers/recurring charges), not generic tooling — therefore it grants direct financial execution capability.