alby-hub-skill

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation instructions instruct fetching and executing remote install scripts (e.g. /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/getAlby/hub/master/scripts/linux-x86_64/install.sh)" and the aarch64 and Pi variants at https://raw.githubusercontent.com/getAlby/hub/master/scripts/linux-aarch64/install.sh and https://getalby.com/install/hub/pi-aarch64-install.sh), which download and run remote code at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for managing a Lightning node and exposes payment- and wallet-related functionality. The docs list commands for "Payments: Pay/make invoices, transactions, lookup, balances, wallet address", channel management and LSP ordering, and NWC app creation (create-app returns a nostrWalletConnectUrl that "grants wallet access within the app's scopes and budget"). It also warns that the saved JWT token ("~/.hub-cli/token.jwt") "grants full hub API access". These are specific crypto/financial APIs and capabilities (wallet access, invoice/payment operations, channel/liquidity management), not generic tooling — therefore it provides direct financial execution capability.