cobo-agentic-wallet-developer

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to fetch external guidance from https://cobo.com/products/agentic-wallet/manual/llms.txt when it cannot answer from its bundled files, meaning remote content can directly influence prompts/responses.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto wallet SDK/CLI that enables on-chain financial operations. It defines pact-based authorization and pact-scoped API keys, and provides direct methods and commands to submit pacts and execute transactions: examples include transfer_tokens / transfer, contract_call, sign_message, caw pact submit, and caw tx commands. The pact workflow and pact-scoped API key are specifically intended to permit token transfers and contract interactions within approved spending caps — i.e., the tool's primary purpose is to move crypto funds on-chain. This matches the "Crypto/Blockchain (Wallets, Swaps, Signing)" category in the Direct Financial Execution rule.