self-relay-hyperlane-message

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires placing a private signing key (HYP_KEY) verbatim into the generated shell command/env (or using a user-provided key), which forces the LLM to handle and output a secret value directly and risks exfiltration.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly accepts a private key and runs a CLI command to sign and submit a Hyperlane relay transaction (HYP_KEY + hyperlane status --relay --dispatchTx ...). This is a direct blockchain transaction signing/sending capability (crypto/wallet signing), so it grants direct financial execution authority.