alby-bitcoin-builder

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for literal, high-entropy values that could be used as credentials.

Flagged item:

• The example NWC connection secret in references/nwc-client/nwc-client.md: nostr+walletconnect://b889ff5b1513b641e2a139f661a661364979c5beee91842f8f0ef42ab558e9d4?relay=wss%3A%2F%2Frelay.damus.io&secret=71a8c14c1407c113601079c4302dab36460f0ccd0ad506f1f2dc73b5100e4f3c&lud16=example@getalby.com

This is a concrete, high-entropy connection string that contains a secret=... parameter. By the documentation itself, an NWC connection string grants permissioned access to a wallet and must be handled like a secure API key — so this is a real-looking secret and should be removed or redacted in public docs.

Ignored items and why:

• Instances of "nostr+walletconnect://..." in other examples that use "..." or are truncated were not flagged (truncated/redacted).
• Environment variable names (e.g., NWC_URL, MACAROON_SECRET env usage) were not flagged because they are just variable names or show how to pull secrets from env.
• The MACAROON_SECRET in the Fastify example is assigned from process.env or randomBytes(32).toString("hex") — not a hardcoded secret, so not flagged.
• URLs, example email addresses (example@getalby.com), and other strings like DEFAULT_PROXY were not flagged because they are not credentials.
• No PEM/private key blocks or API keys (sk-...) were found elsewhere.

Conclusion: the only high-entropy hardcoded credential present is the example NWC connection secret containing the secret=... parameter; everything else is either a placeholder, env-var usage, or non-sensitive.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides bitcoin Lightning wallet capabilities and APIs for sending and receiving payments (NWC Client), requesting invoices and parsing/verifying BOLT-11 invoices and preimages (Lightning Tools), and browser components for connecting wallets and accepting payments (Bitcoin Connect). It also references testing and production wallets. These are specific crypto/wallet/payment functions intended to move value, not generic tooling, so it grants direct financial execution authority.