hunch

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires producing and embedding an x402 EIP-3009 signature (base64 X-PAYMENT header) into POST /trade requests, which mandates the agent handle sensitive signing material and include it verbatim in requests (a secret-exfiltration risk unless signing is strictly performed outside the LLM).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill performs runtime calls to https://www.playhunch.xyz and renders server-provided fields (headline, quote, tokenSnapshot, broadcast, etc.) verbatim into agent replies, so external content from that origin directly controls the agent's output and is a required dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to move money on-chain: it supports placing bets that settle in USDC on Base via an x402 payment flow (POST /api/partner/trade with an X-PAYMENT header), requires signing an EIP-3009 transferWithAuthorization, and includes explicit guidance for swapping tokens → USDC and retrying payment flows. It names on-chain receipts, txHash/proofUrl, wallet-keyed positions, and pinned signing policies (payTo/asset/network/amount). These are direct crypto payment/transaction actions rather than generic I/O, so it grants Direct Financial Execution authority.