frontpage-buy-ad

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt's examples and payment flow require embedding sensitive values verbatim (e.g., privateKeyToAccount('0x...'), previewToken in the POST /api/buy body and Authorization: Payment tokens), forcing the agent to handle/output secrets directly.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). Yes — this skill is explicitly designed to initiate on-chain/token payments and flip ownership of paid inventory. It documents the full payment flow (POST /api/preview to mint a payment token and POST /api/buy which "charges nextPrice exactly, flips the square"), references USDC on the Tempo network, and shows SDK usage (Mppx + tempo + privateKeyToAccount) that signs/transmits USDC transfers and handles 402 payment challenges and refunds. Those are direct financial execution primitives (crypto wallet signing, token transfer, charging and refunding), so it grants direct financial execution authority.