It could probably be adapted from the flood counter, where instead of counting how many times they say something, it would check to see if they said 'link' one time. In the action section, you would check to see if the warning flag exists. If it does not exist, you set the warning flag and give the warning. But if it does already exist, you lower the boom.
It was ambiguous if you to ban all links or exempt some. To ban a link, you'd need to come up with a definition for what that is, especially if you want to flag strings containing http or beginning with it, containing www. etc. It can get very easy to have false positives.
