sweep

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs converting and embedding WIF private keys (e.g., PrivateKey.fromWif('L1aW4aubDFB7yfDYK...')) and passes PrivateKey[] into actions, requiring the agent to handle user private keys verbatim — a high-risk secret-exfiltration pattern.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to move crypto assets. It provides specific actions (sweepBsv, sweepOrdinals, sweepBsv21, sweepDeposit) that take PrivateKey objects, build and sign transactions, and submit them (examples show execute(...) returning txid). This is direct crypto wallet transaction execution (sweeping BSV, ordinals, and BSV21 tokens), so it grants direct financial execution authority.