alby-bitcoin-builder

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill documentation for literal, high-entropy values that could be used as credentials.

Flagged:

• The example NWC connection secret in references/nwc-client/nwc-client.md: nostr+walletconnect://b889ff5b1513b641e2a139f661a661364979c5beee91842f8f0ef42ab558e9d4?relay=wss%3A%2F%2Frelay.damus.io&secret=71a8c14c1407c113601079c4302dab36460f0ccd0ad506f1f2dc73b5100e4f3c&lud16=example@getalby.com

This contains a high-entropy secret parameter (the secret=... hex string) which meets the definition of a secret: a literal, random-looking value that grants access to a wallet.

Ignored / not flagged:

• Placeholder/truncated values like "nostr+walletconnect://..." elsewhere — documentation placeholders, not real credentials.
• BOLT-11 invoice placeholders ("lnbc..."), sample invoices, and example simple strings — low-entropy/documentation examples.
• Environment variable names (e.g., MACAROON_SECRET, NWC_URL) and code that generates a random secret at runtime (randomBytes(...)) — these are not literal leaked secrets.
• URLs and public constants (e.g., DEFAULT_PROXY) — not secrets.

Conclusion: there is at least one high-entropy, potentially usable credential present (the example NWC connection string with secret).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides bitcoin Lightning wallet capabilities and APIs for sending and receiving payments (NWC Client), requesting invoices and parsing/verifying BOLT-11 invoices and preimages (Lightning Tools), and browser components for connecting wallets and accepting payments (Bitcoin Connect). It also references testing and production wallets. These are specific crypto/wallet/payment functions intended to move value, not generic tooling, so it grants direct financial execution authority.