algokit-utils-py

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The file references/ed25519.md includes an example RawEd25519Signer that performs an HTTP POST to "https://my-signer.example.com/sign" at runtime to obtain signatures, which delegates signing (i.e., execution of signing logic) to a remote service and thus is a runtime external dependency executing remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to build, sign, and submit Algorand transactions and to manage signing keys/wallets. It references payments, asset transfers, atomic transaction groups, account management/funding, algorand.send.* (which "builds, signs, and submits in one call"), raw app call send APIs, and low-level Ed25519 signing primitives. These are specific crypto/blockchain transaction and signing capabilities that enable moving value (payments/ASA transfers, swaps, signing transactions) — i.e., direct financial execution authority.