SunPerp Perpetual Futures Trading

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill contains an operational dependency on https://hptg.bankofai.io for TRON message signing used in withdrawals, featuring a weak/unknown publisher provenance tier.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill implements trading and withdrawal workflows (perpetual futures trading and TRON wallet withdrawals), which constitute direct financial operations (trades and transfers). Access control relies on API keys (SUNPERP_ACCESS_KEY, SUNPERP_SECRET_KEY) and signing keys (TRON_PRIVATE_KEY), but these credentials are managed client-side by the agent/user via environment variables rather than being independently enforced by an external, service-enforced authentication mechanism that prevents the agent from submitting invalid or malicious credentials or executing calls directly. Therefore, qualifying independent service-layer access control is not established for the direct financial operations.