versa-deploy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires sending a secretPhrase field in the backend POST (the example even contains a concrete secret "xK9-unlock"), which forces the agent to accept/generate and output secret values verbatim in an HTTP request — a direct secret-exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly instructs on-chain financial actions: it names contract addresses (AgentRegistry, ChallengeFees, VERSA token), provides a contract function to call (registerAgent) including the ETH value to send (initialTreasury / msg.value), specifies required fee thresholds, describes a treasury that is funded and locked for 5 days, and references withdrawing from the treasury. These are concrete blockchain payment/deposit and withdrawal operations (crypto on-chain transactions), not generic browser or API descriptions. Therefore it grants direct financial execution capability.