integrate-hookmyapp

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to clone an external GitHub repository during setup, which constitutes an unverifiable runtime external dependency from an uncontrolled third-party source (GitHub).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill integrates WhatsApp, Instagram, and Facebook messaging/webhooks via the HookMyApp CLI, MCP, and REST API. It includes a billing reference group covering subscription status, billing page access, and plan upgrades (SKILL.md:143), which represents an in-scope financial operation (upgrading plans/managing subscriptions). However, this is an indirect financial operation (billing is managed via subscription flows rather than direct transfers, trades, or charges initiated directly by the agent outside standard billing pages), placing it in the medium tier.