mp-security

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly requires loading and executing the MercadoPago client SDK at runtime from https://sdk.mercadopago.com/js/v2, which fetches and runs remote JavaScript and is a required dependency for tokenization.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly documents Mercado Pago payment-security features and APIs (Card Tokenization, Supertoken, Vault, 3DS) and describes flows that create payments and enable future charges (e.g., "Server uses token in payment creation", "Use supertoken for future charges without re-tokenizing", "Supertoken API", "Vault API", "tokenization endpoints"). These are specific payment gateway capabilities intended to execute financial transactions (charging cards, storing tokens for recurring charges), not generic tooling. Therefore it grants direct financial execution authority.