layer-2s

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes examples that pass a private key on the command line (e.g., --private-key $KEY), which is an insecure pattern that encourages embedding secrets in generated commands and risks secret exfiltration even though placeholders are used.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The document contains specific, actionable crypto/blockchain execution capabilities: explicit deploy and transaction commands that use private keys (e.g., "cargo stylus deploy --private-key $KEY"), an example integration of Coinbase Smart Wallet SDK/provider, paymaster code for charging in ERC-20, RPC endpoints for direct node access, and concrete bridge/DEX recommendations (Across, Stargate, Hop, dominant DEX routing). These are not generic tools — they are concrete blockchain wallets, signing/deployment commands, bridge and swap integrations that enable sending transactions and moving funds. Therefore it grants direct financial execution authority.