wf-api-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to ask users for sensitive values (clientId, userId, private key paths) and explicitly requires those real values to be filled directly into the generated WfConfig code, forcing the LLM to embed secrets verbatim in its output.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to integrate with WorldFirst payment APIs and includes concrete, money-moving endpoints and workflows: createTransfer (account-to-account transfers), createPayout (payouts to third-party bank accounts/e-wallets), consultPayout/consultTransfer (quote/pricing for transfers/payouts), inquiryTransfer/inquiryPayout (status checks), and handling of async payment notifications. It requires real WF credentials (clientId, userId), RSA private keys for signing requests, and even generates tests that perform real HTTP calls. These are specific financial execution capabilities (payment/banking APIs) rather than generic tooling.