solana-testing

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). I flagged https://release.anza.xyz/stable/install because the CI workflow runs sh -c "$(curl -sSfL https://release.anza.xyz/stable/install)" which fetches and executes remote code at runtime to install the Solana CLI, making it a required runtime dependency that can control execution.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill docs explicitly show blockchain transaction creation, signing, and submission (e.g., Transaction::new_signed_with_payer, svm.send_transaction(tx), RpcClient against a mainnet fork, Anchor client .signer(...).send()). It demonstrates SPL token operations (initialize_mint2, creating ATAs, minting/transferring tokens), airdrops, and running against real/mainnet token state. These are concrete crypto/blockchain transaction APIs and wallet signing flows that can move tokens/lamports and thus constitute direct financial execution capability.