what-is-agentpmt

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs callers to "Copy the Agent Group Bearer Token" and to call REST/MCP with an Authorization: Bearer <agentpmt_bearer_token> header, which requires embedding a secret bearer token verbatim into requests or generated commands (an exfiltration risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs agents at runtime to connect to the main AgentPMT MCP server (https://api.agentpmt.com/mcp/) and call endpoints like tools/list to fetch tool and workflow instructions that directly determine agent actions, so this external URL controls prompts/behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly enables agents to make and receive payments: it documents payment flows, a REST product purchase endpoint (https://api.agentpmt.com/products/purchase), AgentAddress credits, x402-capable funded wallets, signing requests/x402 payment challenges, and Agent Group bearer-token based purchase calls. These are specific financial execution capabilities (wallet signing and payment endpoints), not generic tooling, so it grants direct financial execution authority.