sequence-ecosystem-wallet

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The workflow instructs pasting secrets/ciphertext and API keys directly into CLI commands (inline environment assignments and a quoted --ciphertext argument), which requires the agent to handle and output secret values verbatim — an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly for a Polygon wallet ecosystem and includes CLI commands to perform on-chain financial actions: creating wallet/session links, ingesting session keys, checking balances, and—critically—executing Trails swaps (USDC→USDT, USDC→POL) with a --broadcast option. The workflow and outputs (depositTxHash, intentId, block explorer links, receipts) show it signs and broadcasts blockchain transactions. It therefore provides direct crypto/blockchain transaction execution capabilities (wallet operations and swaps) rather than a generic tool.