vercel-env-puller

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly handles and injects real payment credentials: manifests include STRIPE_SECRET_KEY (category "payments") and the runtime resolve_for_run pulls actual secret VALUES via vercel env pull and returns an env dict that is placed into the Sandcastle agent's runtime. Supplying live Stripe secret keys to an agent’s process is a specific capability to authorize and execute payment-gateway actions (i.e., move money). Although the code applies controls (ephemeral tmpfs, logging restrictions, criticality alerts), the primary and explicit effect is delivering live payment API credentials to an agent, which grants Direct Financial Execution authority.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt instructs the agent/runtime to pull real production secrets with vercel env pull, create tmpfs/fifo files and write a config containing secrets (then unlink), i.e. it directly performs state-changing host operations that expose sensitive credentials (even though it doesn't request sudo), which is a high-risk compromise of the machine's sensitive state.