alby-builder-skill

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the documentation for literal, high-entropy values that could be usable credentials. I found a concrete NWC connection string in the NWC Client section that contains two long hex values (not placeholders):

Example NWC connection secret: nostr+walletconnect://b889ff5b1513b641e2a139f661a661364979c5beee91842f8f0ef42ab558e9d4?relay=wss%3A%2F%2Frelay.damus.io&secret=71a8c14c1407c113601079c4302dab36460f0ccd0ad506f1f2dc73b5100e4f3c&lud16=example@getalby.com

• The initial path component (b889ff5b...) and the secret parameter (71a8c14c...) are long, random-looking hex strings meeting the high-entropy criterion and are of the form used as connection secrets / API keys. This should be treated as a real credential (not a placeholder) and redacted from public docs or marked clearly as a redacted example.
• I ignored other items that are names, environment-variable placeholders, example URLs, or generated-at-runtime values (e.g., MACAROON_SECRET shown as an env var or randomly-generated fallback) because those are not literal secrets included in the text.

No other literal high-entropy secrets were present.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides bitcoin Lightning wallet capabilities and APIs for sending and receiving payments (NWC Client), requesting invoices and parsing/verifying BOLT-11 invoices and preimages (Lightning Tools), and browser components for connecting wallets and accepting payments (Bitcoin Connect). It also references testing and production wallets. These are specific crypto/wallet/payment functions intended to move value, not generic tooling, so it grants direct financial execution authority.