cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The doc includes examples that place a WIF private key in an environment variable and pass a WIF via a --wif command-line argument, which requires embedding the secret verbatim in commands/outputs (high exfiltration risk).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a Bitcoin SV wallet/ordinals CLI exposing commands and APIs to move funds and manage keys: e.g., wallet send, send-all, BSV21 token send/mint/buy, sweep/import (sweeping UTXOs), remote top-up and a server endpoint for POST /account/payment, and an action escape hatch (sendBsv). These are specific financial execution capabilities (sending, buying, topping-up, sweeping, minting tokens), not generic tooling.