genlayer-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows passing private keys and plaintext passwords as command-line arguments and via shell piping (e.g., --private-key 0x..., --password "mypassword", echo "mypassword" | ...), which forces any agent that emits those commands to include secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a blockchain CLI that explicitly supports account creation/import (including private-key import), unlocking key material, signing transactions, and sending tokens/transactions (e.g., genlayer account send, genlayer write, genlayer deploy). It also documents non-interactive password options for automating these actions. These are direct crypto/transaction execution capabilities (wallet, signing, and sending funds), so this grants Direct Financial Execution authority.