scenario-model-comparison

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The instruction to install skills via npx skills add scenario-labs/skills uses an unverified third-party repository and package manager command, introducing an operational dependency of unknown provenance.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents a model comparison workflow using generation and execution tools like model_run which involve billed costs (cuCost, budget gates, paid calls). This constitutes a direct financial operation (purchasing model generations). The document mentions no independent access controls enforced by the execution layer for these payment/run routes, relying entirely on the agent following instructions and budget gate rules. Therefore, it falls under direct operations without established qualifying control.