agent-wormhole

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes and executes remote code at runtime via the pinned npm package (e.g. using npx -p @builtbyecho/agent-wormhole@0.1.2 agent-wormhole, https://www.npmjs.com/package/@builtbyecho/agent-wormhole), so external package content is fetched and run as a required dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates with Bankr x402 paid opens and shows concrete commands to perform paid calls (e.g., "bankr x402 call ... --max-payment 0.01" and references to BANKR_PAYER_CONFIG). It also references wallet-based EIP-191 signatures for holder access. These are specific payment/crypto-related APIs and CLI calls (Bankr and wallet signature-based access), not generic tooling, so the skill grants direct financial execution capability.