upgrade-sumup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly lists https://developer.sumup.com/llms.txt as the "LLM entrypoint", indicating it would be fetched at runtime to supply prompts/instructions that directly control the agent's behavior, so it is a runtime external dependency that controls prompts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is specifically about SumUp (a payment gateway) SDKs and Checkouts API migration: it references endpoints, merchant_code usage, webhook/3DS handling, and explicitly instructs running sandbox "happy path" payments and deliberate failure tests. This is a purpose-built integration guide for a payment provider (i.e., moving/processing payments), not a generic tool, so it provides direct financial execution capability.