antseed-connect

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The SKILL instructs installing a Pi extension with the git URL git:github.com/AntSeed/pi-antseed (via "pi install git:github.com/AntSeed/pi-antseed"), which fetches remote code that will be installed/run by Pi and can directly alter agent behavior, so it is a runtime external dependency that executes remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes crypto/payment functionality: it requires and manages an EVM private key (ANTSEED_IDENTITY_HEX / identity.key), instructs depositing USDC on Base via "antseed payments", and the buyer proxy "authenticates and pays peers using the local node's identity key and on-chain USDC deposits" (including opening a payment channel — an on-chain transaction). These are specific blockchain wallet/signing and on-chain payment operations (moving USDC, opening channels), not generic HTTP or code-execution capabilities. Therefore it grants direct financial execution authority.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). This skill document instructs agents to perform system-level operations (e.g., "sudo systemctl restart hermes") and to edit local config/state files, which could cause the agent to request or require elevated privileges and modify the host state.