payram-no-kyc-crypto-payments

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs downloading and executing a remote bash script from https://payram.com/setup_payram.sh via curl during runtime setup, representing a weak/unknown publisher operational dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents a self-hosted crypto payment gateway (PayRam) that initiates direct crypto payments and checkout flows via SDK calls (payram.payments.initiatePayment). Direct financial operation: yes. Control evidence: API keys and self-hosted infrastructure authentication are documented, but these are self-managed credentials without an independent service-layer or third-party access check (no-KYC, permissionless architecture). Therefore, qualifying independent access control is absent, making it high severity.