ranger-finance

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs instruct cloning and running the ranger-agent-kit (git clone https://github.com/ranger-finance/ranger-agent-kit.git followed by python -m ranger_mcp), which fetches remote code and executes it to run the MCP server that exposes agent tools — a runtime external dependency that executes remote code and controls agent behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides trading APIs and transaction execution for crypto markets: it documents SorApi methods like increasePosition/decreasePosition/closePosition and executeTransaction, includes MCP tools (sor_increase_position, sor_decrease_position, sor_close_position) for AI agents, and shows signing/executing transactions using a WALLET_PRIVATE_KEY. These are specific crypto market order and wallet-signing capabilities that enable direct financial execution.