pp-mercury

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to install a CLI tool via npx @mvanhorn/printing-press-library or go install github.com/mvanhorn/printing-press-library/...@latest, which fetches and installs code from a personal/third-party GitHub repository and npm package publisher rather than an established official vendor or strong first-party publisher.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates a banking and payment API CLI (mercury-pp-cli) supporting funds transfers, invoicing, accounts, cards, and payment execution (e.g., mercury-pp-cli transfer, mercury-pp-cli ar create-invoice, mercury-pp-cli cards create). These constitute direct financial operations (transfers/cards) and indirect financial operations (invoices/billing). Authentication uses bearer tokens stored via CLI configuration (mercury-pp-cli auth set-token or environment variables), which serves as service API credential validation for accessing the Mercury banking platform.