webly

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The script fetches skill updates from raw.githubusercontent.com/Webly-AI/webly-plugin, which is an unofficial third-party repository providing executable plugin materials and update instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates a website hosting and deployment service ("Webly") that handles free and paid plans (Hobby and Pro), upgrades, plans, storage limits, and billing states (e.g., handling 402 plan required, billing checks, upgrade URLs). However, it does not directly move, trade, charge, or request money/financial assets itself; rather, it handles file sharing, website deployment, and delegates billing / plan upgrades to external web URLs (details.upgradeUrl) when limits are reached. Therefore, the financial operation type is indirect (managing billing status, upgrades, and storage quotas), leading to a medium rating.