igrantio-dcql-query-sca-payment-user

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the runtime fetch of the issuer VCT metadata to read attribute names and display labels—i.e., it uses https://demo-api.igrant.io/service/vct-metadata/payment_service_user at runtime to determine what to present to users, which directly controls prompts/instructions.