apify-actorization

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most links are official Apify docs/pages and safe references, but the raw GitHub-hosted shell script (bootstrap-ubi.sh) — shown being fetched and piped to sh in the Dockerfile example — is a high-risk distribution vector because executing remote scripts (and tools that install binaries from arbitrary GitHub releases) can fetch and run malware.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation explicitly describes monetization and a billing API: "Charge for events in your code with await Actor.charge('result')" and guidance on configuring Pay-Per-Event monetization in Apify Console. This is a specific API call to charge users/collect payments, i.e., direct financial execution capability, not a generic tool or browser automation.