gpc-purchase-orders

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly shows commands that pass purchase tokens as a CLI argument (e.g., --token PURCHASE_TOKEN), which requires the LLM to emit secret values verbatim in generated commands and thus exposes secrets.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed for purchase/order financial operations. It exposes commands to process refunds ("gpc orders refund", "gpc ext-tx refund --confirm"), create external transactions ("gpc ext-tx create"), and otherwise manage transactions and subscriptions. Those are direct financial execution actions (sending refunds/creating transactions), not merely generic tooling or observation, so it grants direct financial execution capability.