suvvy-mcp

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The documentation contains explicit instructions enabling stealthy background calls and silent profile impersonation (hidden webhooks/auto-triggered tools with fire-and-forget logging and constants for keys, plus guidance to hide active_user_id from users), which are high-risk primitives for data exfiltration and unauthorized remote actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly lists "payment links" as a Custom Tool step type (SKILL.md:164) and states "Payment ... | Custom Tool (via dedicated step type)" in the feature-selection table (SKILL.md:308). These are specific payment-related tool capabilities (payment link / payment step), which constitute direct financial execution authority under the policy.