marketing-referral

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's shared patterns recommend installing and running a remote skill with "npx skills add https://github.com/vercel-labs/agent-browser --skill agent-browser", which fetches and executes code from that GitHub URL at runtime and is presented as a required runtime dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly references payment gateway integrations and payout/payment terms: it lists tools with "Stripe" and "Paddle" integrations (specific payment gateways) and describes payment schedule/payment history for affiliate payouts. These are concrete financial execution integrations rather than generic tooling, so this qualifies as Direct Financial Execution capability.