volcengine-sale

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill contains instructions to automatically install external skills from GitHub repositories (e.g., https://github.com/volcengine/ark-cli, https://github.com/volcengine-tls/ve-tls-cli) during runtime via user authorization, representing a weak/unknown third-party operational dependency source tier.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill handles Volcengine commercial products, offering direct purchase/provisioning (buy), pricing inquiries (price), and subscription cancellations/refunds (unsubscribe) as documented in SKILL.md:4-10 and SKILL.md:39-41. It uses the ve command-line tool (SKILL.md:23, SKILL.md:60) for operations. Authentication and access control are handled by ve itself and its login mechanism (SKILL.md:60), fulfilling the criteria for direct financial operations with established independent service access control.