apideck-mcp

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill requires contacting the hosted MCP endpoint (https://mcp.apideck.dev/mcp) at runtime to fetch tool definitions/schemas that directly shape the agent’s available tools and prompts (and the recommended local option npx -y @apideck/mcp fetches and executes remote package code), so external content both controls agent instructions and can execute code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes Apideck unified Accounting and payment workflows (e.g., accounting invoices, bills, payments, and explicit workflow tools like apideck-pay-bill and apideck-receive-customer-payment). These are purpose-built financial actions (paying bills, recording/creating payments) and thus provide direct financial execution capability.