batch

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill mandates running npx starkfi@latest at runtime (which fetches and executes remote package code from the npm registry, e.g. https://registry.npmjs.org/starkfi), so it relies on and executes externally-fetched code as a required dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to execute on-chain DeFi transactions on Starknet. Its primary purpose is financial: composing atomic multicall transactions that perform swaps, token sends, staking, lending actions (supply/borrow/repay/withdraw), DCA order creation/cancellation, and related operations. The CLI shown (npx starkfi@latest batch ...) directly broadcasts transactions, requires wallet authentication and balances, and includes post-execution tx-status checks. These are specific, explicit mechanisms to move and manage funds on-chain (not generic tooling), so it grants direct financial execution authority.