ai-marketing-kit-orchestrator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs cloning and installing software from an unverified third-party GitHub repository (crealwork/ai-marketing-kit) and a Claude Code marketplace plugin, constituting a weak/unknown/suspicious operational dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill includes a paid ads workflow (paid-ads, create_paid_ad_campaign) that executes campaign creation and ad spend via API (Zernio API) based on user-provided budget parameters. This constitutes a direct financial operation (charges/purchases/advertising spend). However, qualifying independent access control is present: the execution layer and workflow require authenticated API credentials via ZERNIO_API_KEY (configured in environment variables and checked during execution) combined with mandatory user approval gates (budget_info = ask_user(...), confirmation = ask_user(...)) before campaign creation/spend instructions are routed to the platform API.