SunPerp Perpetual Futures Trading

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (critical risk: 1.00). The script scripts/wallet.js uses an unofficial or hardcoded third-party TronGrid host (https://hptg.bankofai.io) for signing messages with user private keys, which introduces an unauthorized credential exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The script scripts/wallet.js incorporates a hardcoded fallback URL (https://hptg.bankofai.io) for TRON full-node RPC connection during signing without proper first-party provenance, constituting a weak runtime external dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL.md documentation explicitly provides tools and APIs for market orders, futures trading, position management, and crypto wallet withdrawals (TRON blockchain), which falls under Direct Financial Execution Authority (Crypto/Blockchain wallets, Swaps, Signing, and Market Orders).