alkahest-user

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly shows private keys and mnemonics embedded verbatim in command-line flags and environment variables (e.g., --private-key 0xKEY, --mnemonic "...", ALKAHEST_PRIVATE_KEY=0x...), which requires the LLM to handle and potentially emit secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL.md defines a CLI that explicitly sends and manages crypto assets: it requires private keys/mnemonics (wallet auth), and has commands to create escrows (ERC20/ERC721/native), collect/reclaim escrows, perform payments (ERC20 and native), create barter offers/fulfillments, and commit/reveal flows that "send bond as ETH". These are direct crypto/blockchain transaction capabilities (wallet signing and moving funds), not generic tooling — therefore it grants Direct Financial Execution authority.