paypal-integration

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill includes a client-side script tag that fetches and executes remote JavaScript at runtime (https://www.paypal.com/sdk/js?client-id=YOUR_CLIENT_ID&currency=USD), which is a required runtime dependency that runs external code in the client.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a PayPal payment integration: it contains concrete, specific API calls and helper functions that create and capture orders (create_order, capture_order -> POST /v2/checkout/orders/{id}/capture), create refunds (create_refund -> POST /v2/payments/captures/{capture_id}/refund), create subscriptions/billing plans (v1/billing/plans, v1/billing/subscriptions), and references Payouts. It uses OAuth client_id/client_secret to obtain access tokens and performs POST requests to PayPal endpoints to move funds. These are direct payment gateway operations (sending/refunding/capturing payments, managing subscriptions/payouts), not generic or hypothetical tools—so the skill grants direct financial execution authority.