elfa-gmx

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs at runtime to "fetch" the companion elfa-ai skill from the GitHub repository https://github.com/elfa-ai/skills, which is a required external code dependency that controls API mechanics and Builder Chat behavior used by the agent.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provisions API-based crypto trading: it describes automated GMX perp trading where Elfa Auto executes market or limit orders, references trade endpoints (/v2/auto/* and /v2/trade/*), and requires an Elfa API key and HMAC secret for trade-action mutations. These are specific financial execution capabilities (crypto exchange order placement), not generic tooling.