pp-lemonsqueezy

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisites instruct running runtime installers that fetch and execute remote code — e.g. "npx -y @mvanhorn/printing-press-library install lemonsqueezy --cli-only", "go install github.com/mvanhorn/printing-press-library/library/payments/lemonsqueezy/cmd/lemonsqueezy-pp-cli@latest", and "go install github.com/mvanhorn/printing-press-library/library/payments/lemonsqueezy/cmd/lemonsqueezy-pp-mcp@latest" — and the CLI/MCP are required for the skill to operate.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a dedicated CLI for Lemon Squeezy (a payment platform) and exposes explicit payment-related operations: it can create checkouts (POST /v1/checkouts), create/delete discounts, and cancel/update subscriptions, and it requires an API key for Bearer auth. These are specific payment-gateway/billing operations (i.e., financial execution capabilities), not generic tooling, so it grants direct financial execution authority.