compose-solana-transactions-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt tells an agent to capture literal prior-command outputs and substitute them into subsequent commands (including the SOLANA_KEYPAIR JSON) and to show exact commands for secret-related CLI actions, which forces handling or embedding private-key/secret values verbatim and creates an exfiltration risk even though safer piping patterns are suggested.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Preflight step instructs running sh -c "$(curl -sSfL https://release.anza.xyz/stable/install)", which fetches and immediately executes a remote install script from https://release.anza.xyz/stable/install (remote code execution during setup), and the Solana CLI installed by that script is presented as a required dependency for the skill.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly builds, signs, and sends Solana blockchain transactions: it loads a private keypair from the SOLANA_KEYPAIR secret (JSON byte array), constructs a Solana transaction in src/tasks/solana-writer.ts, signs it with that keypair, and sends it to the configured SOLANA_RPC_URL RPC. The doc even warns that an HTTP-triggered task with authentication: "none" lets anyone call the endpoint and "drain the keypair's SOL." This is a specific crypto/blockchain execution pathway (wallet signing + on-chain send), so it grants direct financial execution authority.