algokit-utils-ts

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the 25-word BIP39 mnemonic because it is a literal, usable seed phrase that can be converted to an Ed25519 keypair — i.e. it is a credential that would grant access to any account derived from it. Although this particular mnemonic is a commonly used example/test vector, it is still a real mnemonic present verbatim in the docs and therefore a high-risk secret if copied into real code or wallets.

I did not flag other values in the docs (for example "my-algod-api-token", "my-indexer-api-token", environment variable names like DISPENSER_MNEMONIC or ALGOKIT_DISPENSER_ACCESS_TOKEN, or base64 placeholder labels like "vote-key-base64") because those are obvious placeholders/documentation examples or mere variable names rather than literal high-entropy credentials.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly targets Algorand transaction and account operations: it documents Payment and Asset transactions, TransactionComposer with .addPayment/.addAssetTransfer, raw app calls, account key management and signing primitives (Ed25519, wrapped secrets), and notes that algorand.send.* "builds, signs, and submits in one call". Those are direct blockchain financial execution capabilities (creating, signing, and submitting payments/asset transfers/app calls), so this skill grants direct financial execution authority.