bankr

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to request OTPs/API keys and to construct/emit commands and curl headers that include those secrets verbatim (e.g., --api-key, --llm-key, X-API-Key headers, --code ), which requires the LLM to handle and output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.95). The skill documentation contains multiple high-risk operational patterns that enable credential capture, stealth fund transfers, and remote code execution/exfiltration (notably: explicit guidance to solicit OTPs for headless login, agent-driven deployment of x402 handlers that can access environment secrets, synchronous sign/submit of arbitrary transactions and automatic payment/top-up flows), which together create clear avenues for intentional abuse or backdoor behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly grants the agent a built-in headless web browser and shows workflows that "Open URLs", "Read page content, extract data" and examples like "Browse coingecko.com" and "Go to this URL and extract the token contract address" (and also public tweets via /agent-profiles/:identifier/tweets), so the agent ingests untrusted public web/social content which can influence subsequent actions such as trades or transaction submission.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto trading and wallet API. It defines concrete wallet and payment endpoints and commands that move funds: /wallet/transfer, /wallet/sign, /wallet/submit (synchronous write endpoints), CLI commands like bankr wallet transfer, token swaps, bridging, limit/stop-loss orders, leverage trading (Hyperliquid/Avantis), arbitrary raw transaction submission, token deployment (which involves on-chain payments), x402 paid API calls with automatic USDC payment, and LLM credit top-ups from wallet. These are specific, primary financial operations (wallet management, signing, sending transactions, executing trades/payments), not generic tooling. Therefore it grants Direct Financial Execution Authority.