alpaca

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The README instructs cloning and running the repository via git clone https://github.com/zapier/connectors.git (then npm install / node), which fetches remote code that is built/installed and executed as part of setup/runtime, so this is a runtime external dependency that executes remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes Alpaca Trading API operations that place and manage market activity: scripts and descriptions talk about placing orders to buy/sell stocks, crypto, and options (placeOrder, replaceOrder, cancelOrder), closing/liquidating positions (closePosition, closeAllPositions), and exercising options. It therefore provides specific, explicit market-order / trading execution capabilities (paper by default; live trading available with explicit opt-in), which constitutes Direct Financial Execution authority.