altllm-portal-auth

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly allows and documents passing a raw private key on the command line (--private-key --allow-unsafe-private-key-argv), which requires the LLM to include secret private key values verbatim in generated commands/outputs, creating a high exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly implements crypto wallet authentication and signing: it provides commands to load private keys (env, file, inline), a prepare/nonce+signature verify flow for external signing, and explicitly supports EVM/Ethereum-style signatures and external signers (Privy). These are specific crypto wallet/signing capabilities (private key handling and signature issuance) which constitute direct financial execution authority under the "Crypto/Blockchain (Wallets, Swaps, Signing)" rule.