portaly-affiliate

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The script fetches code and instructions from a configurable remote URL during runtime execution, making it a high-risk unverifiable external dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill's documented operation involves setting up buyer promotion, configuring referral codes, and attaching profitSharingId to server-side checkout session creation (POST /api/creator-subscription/checkout-sessions), which integrates with a payment platform (Portaly Payment) for transactions. These actions represent a direct financial routing and operation (purchases/commissions). However, the skill documentation establishes that API calls require bearer token authentication (Authorization: Bearer {PORTALY_API_KEY}) enforced by the remote Portaly API service layer (independent service-side access control). Therefore, this qualifies as a direct financial operation with independent access control.