meteora

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The guide includes an explicit code snippet using Keypair.fromSecretKey(/* your secret key */), which encourages embedding a private key literal into code (i.e., handling/outputting secret values verbatim), creating a high exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The document is a Solana DeFi SDK guide exposing explicit, purpose-built crypto financial APIs and transaction flows. It includes concrete functions to move value and sign/send transactions: e.g., dlmm.swap (and swap execution with sendAndConfirmTransaction), cpAmm.swap, dbc.buy/dc.sell, vault.deposit/withdraw, m3m3.stake/unstake/withdraw, claimFee/claimReward flows, pool creation/funding, and examples that use wallet keypairs and sendAndConfirmTransaction. These are specific blockchain/crypto operations (swaps, staking, deposits/withdrawals, funding rewards, migrations) intended to execute financial actions on-chain. Therefore it grants Direct Financial Execution authority.