1sat-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples that embed a private key inline (e.g., PRIVATE_KEY_WIF=L1abc... bunx ...) and references plaintext passwords/keys (ONESAT_PASSWORD), which encourages emitting secret values verbatim in commands and thus poses a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly lets the CLI/server talk to arbitrary remote storage URLs (e.g., 1sat remote add <url>, 1sat remote status [url], 1sat remote topup [url]) and builds/uses content URLs from ordinal origin tags — meaning it fetches and interprets untrusted third‑party HTTP JSON/content from user-provided public endpoints as part of its workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes bunx @1sat/cli which, per the "Run any command directly — no install needed" behavior, fetches and executes remote package code at runtime (e.g. https://registry.npmjs.org/@1sat/cli), meaning a remote URL is required and will execute code when run.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a cryptocurrency wallet/CLI for Bitcoin SV (BSV) operations. It defines commands to send BSV and tokens (wallet send, wallet send-all, tokens send, sweep), perform marketplace purchases (ordinals purchase), create timelocks/locks, and invoke actions like sendBsv/lockBsv via the action registry. It includes key management (WIF env, encrypted keystore, Secure Enclave) and runs/signs transactions and a wallet RPC server with payment/top-up endpoints. These are specific, explicit financial execution capabilities (crypto wallet transactions & payments), not generic tooling.