ethermail

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs passing sensitive values verbatim (e.g., export PRIVATE_KEY="0x..." and running wc-connect.js "<WC_URI>"), and WalletConnect URIs include symKey tokens, so the agent would need to handle/emit secret strings directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md and scripts/extract-wc-uri.js explicitly direct the agent to navigate to the public EtherMail login page (https://ethermail.io/accounts/login) and scrape Shadow DOM to extract a WalletConnect URI which is then used to drive login and follow-up actions, so untrusted third-party page content can directly influence the agent's tool usage and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing and running the external "walletconnect-agent" via "clawdhub install walletconnect-agent" (remote code executed at runtime) and it programmatically navigates to https://ethermail.io/accounts/login to extract a WalletConnect URI (wc:...) that directly triggers signing requests, so these runtime-fetched resources can execute code or control agent actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates with WalletConnect and provides concrete scripts and instructions to connect an EVM wallet (e.g., extracting WalletConnect URIs, running wc-connect.js, exporting PRIVATE_KEY). It states the connector "will automatically sign the personal_sign request" and recommends using a dedicated wallet for agent operations. Those are specific crypto/wallet integration and signing capabilities (explicit WalletConnect tooling and wallet private-key usage). That gives the agent direct ability to control and sign actions tied to a crypto wallet (and the skill even references receiving token payments), so it meets the "Crypto/Blockchain (Wallets, ... Signing)" criterion for direct financial execution.