alkahest-developer
Fail
Audited by Snyk on Jul 23, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.90). The skill's code examples explicitly show embedding a private key string literal ("0xPRIVATE_KEY") into client constructors, which requires the LLM to handle or generate verbatim secret values in outputs (insecure credential handling).
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly a blockchain payments/escrow SDK. It shows creating a wallet client with a private key (signing capability), approving ERC-20 tokens, creating escrows, collecting/collecting payments, committing bonds as ETH, and an atomic payment utility (payErc20AndCollect). These are specific crypto/financial operations that can move funds on-chain, so it grants direct financial execution authority.
Issues (2)
W007
HIGHInsecure credential handling detected in skill instructions.
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata