pp-robinhood

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs running "go install github.com/mvanhorn/printing-press-library/library/payments/robinhood/cmd/robinhood-pp-cli@latest" (SKILL.md:23), which fetches and builds remote Go code during setup — a runtime installation step that executes external code and is required for the skill.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a dedicated Robinhood trading CLI and crypto API client that explicitly supports placing and cancelling orders, managing transfers/withdrawals, and signing authenticated trading requests. It includes concrete write commands (e.g., "brokerage orders place", "crypto post-trading-order", programmatic place_order/cancel_order methods) and describes the auth headers/keys and signing required. Although writes default to dry-run, live mutations are supported with explicit flags/environment variables — this is direct financial execution capability.