alby-bitcoin-payments

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes examples and flags that require embedding raw connection secrets or credential strings into CLI commands (e.g., -c/--connection-secret, connect "", and --credentials '{"header":"...","value":"..."}'), which would force the LLM to handle or output secret values verbatim—an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow invokes the Alby CLI discover/fetch commands which (at runtime) fetch and ingest free-form text from outsider-authored public web sources (e.g., 402index.io results and the fetched service/llms.txt content) into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README explicitly instructs the agent to install the skill by fetching the remote skill file at https://getalby.com/payments/SKILL.md, which at runtime would supply agent instructions/prompts and thus directly control the agent.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a wallet/ payments CLI (Alby). It requires a wallet connection secret, exposes commands to "pay" (send to lightning addresses, invoices, crypto/stablecoin addresses, keysend), "receive", "get-balance", "list-transactions", and hold-invoice settlement commands, and includes an automated payment-capable "fetch" that will pay HTTP 402 endpoints (including bridges to pay non-lightning rails). These are specific financial execution operations (sending funds, settling invoices, and paying paid API endpoints), not generic tooling.