orlix

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes live runtime calls to https://orlixai.xyz (notably /api/chat and /api/b20-skill) which forward user chat to upstream AI providers and return AI responses and ABI-encoded deployment transactions that the agent relies on at runtime, so external content can directly influence agent prompts and transaction data.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides blockchain/crypto execution primitives. It includes a B20 Token Studio REST API with actions to read balances, get gas estimates, construct ABI-encoded EIP-1559 deployment transactions ("prepare"), and check transaction receipts. It builds live deployment calldata (to/value/data/gas/nonce), prepares unsigned transactions for on-chain token deployment, and supplies admin/wallet and gas/nonce info — all specific to creating and executing onchain financial transactions. These are concrete crypto/Blockchain operations (deploying tokens, preparing transactions, balance checks), not generic tooling, so this grants direct financial execution capability.