frontpage-buy-ad

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires the agent to accept and then include sensitive values verbatim (the previewToken in the POST /api/buy request and the example raw private key passed to privateKeyToAccount), which forces the LLM to handle secrets directly and creates an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill explicitly performs on-chain/payments: it uses USDC on the Tempo network, exposes POST /api/preview and POST /api/buy that "charges nextPrice" and flips ownership, and the docs include example code using privateKeyToAccount + Mppx/tempo to sign/pay the transfer. The SDK handles the 402 payment challenge and signs the USDC transfer. These are specific payment/crypto execution capabilities (sending money/wallet signing), not generic HTTP or UI actions.