web3-devkit-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installation instructions include a runtime git clone of https://github.com/jazzband/web3-devkit-cli.git followed by npm install / npm run build / npm link, which fetches remote code and executes it locally, so this is a runtime external dependency that can execute code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a web3 developer CLI with built-in wallet management and transaction-sending capabilities. It documents creating wallets, storing/using PRIVATE_KEY environment variables, checking balances, and examples that sign and send on-chain transactions (e.g., using privateKeyToAccount and walletClient.writeContract to transfer tokens, and web3 deploy evm -y which performs deployments). Those are direct crypto/blockchain wallet and transaction (signing/sending) operations — i.e., direct financial execution capability.