agent-wallet

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to ask the user for passwords and API secrets in conversation and pass them directly as command-line arguments (e.g., --password '<pw>' and --app-secret), causing sensitive secrets to pass through the LLM's context and output.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation explicitly configures the agent to use a crypto wallet tool (agent-wallet) which includes capabilities to sign cryptocurrency transactions (agent-wallet sign tx) and manage private keys/wallets on EVM and TRON blockchain networks. This falls directly under the Crypto/Blockchain category for Direct Financial Execution Authority (Risk: 1).