pp-forkable

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs installing required binaries via go install which fetches and builds remote code from github.com (e.g. go install github.com/mvanhorn/printing-press-library/library/food-and-dining/forkable/cmd/forkable-pp-cli@latest and go install github.com/mvanhorn/printing-press-library/library/food-and-dining/forkable/cmd/forkable-pp-mcp@latest), so remote source is fetched and executed as a required install-time dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill's CLI explicitly exposes write/mutation commands that "place real orders and spend" on the user's Forkable account (e.g., meal set, meal set-all, meal confirm, meal skip, reorder). These commands mutate the account and apply real orders when invoked with --confirm, i.e., they can directly cause spending or cancelations on the user's behalf. That constitutes direct financial execution authority (a "send transaction"/place-order capability), so it should be flagged.