polytrackers-agent-skill

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs hosts to run remote code via npx -y @polytrackers/mcp-stdio (e.g., SKILL.md and README.md), which fetches and executes the @polytrackers/mcp-stdio npm package at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly defines real-trade execution tools and scopes: it references pt_trade_preflight and pt_trade_execute, requires an idempotency_key for real trades, and documents the trade:execute / agent:full scopes and tier checks. These are specific APIs for placing real market trades (direct financial execution), not generic tooling.