pp-dub

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill requires installing and running external code at runtime via npx @mvanhorn/printing-press (installer) and go install github.com/mvanhorn/printing-press-library/library/marketing/dub/cmd/dub-pp-cli@latest, which fetches remote code that is executed/installed and is a required dependency for the skill.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The CLI exposes explicit partner/finance operations that modify monetary records: e.g., "dub-pp-cli commissions update" (update an existing commission amount, used for refunds), "commissions bulk-update", partner actions that "mark all commissions as canceled" (partners ban / deactivate), and commands that project and audit payouts ("partners audit-commissions", "bounties payout-projection", plus payouts listing). These are not generic read-only analytics: they include write operations that change commission/payout state and amounts. Combined with Agent Mode (--agent) for non-interactive execution, the skill provides programmatic authority to alter financial obligations within a workspace. That meets the criterion for direct financial execution capability.