nexus

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.95). The skill explicitly requires embedding session secrets (walletSig and transient Bankr API keys) verbatim into API request bodies (and to capture/store the walletSig in-session), which forces the agent to handle sensitive secrets directly and creates an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to execute financial actions. It defines authenticated, order-executing endpoints (POST /trade, /close-position, /cancel, /order-status, /positions, /set-leverage, etc.), agent deployment APIs that can run autonomous live trading (activate/mode/kill with walletSig and explicit GO LIVE flow), and deposit/withdraw flows (proxy/bankr-deposit, proxy/bankr-withdraw) that use a Bankr API key and walletSig. It also requires obtaining a wallet signature via sign_message (cryptographic wallet signing). These are concrete market-order and crypto wallet/transfer operations (including withdraw), not generic tools, so the skill grants direct financial execution authority.