qa

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The checklist explicitly instructs searching for private keys, API keys, and .env files and asks for "specific evidence" on FAILs (file path, screenshots, error messages), which encourages including sensitive credential values verbatim in the report and thus creates an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly centered on onchain financial actions: it instructs the reviewer to trigger and verify wallet interactions and contract writes (connect wallet, click transaction buttons, approve tokens, deposit/withdraw), and to inspect code for concrete transaction-related functions and flows (useScaffoldWriteContract, writeContractAsync, approve, allowance, writeContract). Those are specific crypto/blockchain execution primitives (wallet signing, token approvals, contract writes) that can move funds. Even though framed as a QA checklist, the prompt is specifically about executing and validating onchain transactions and related APIs — therefore it grants direct financial execution capability risk.