kleros-ipfs-upload

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes numerous example commands that inline secrets (EVM_PRIVATE_KEY, CDP_API_KEY_SECRET, CDP_WALLET_SECRET, etc.) as environment-variable assignments on the command line, which forces the LLM/agent to handle or emit secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill explicitly performs on-chain payments: it charges $0.01 USDC per upload, provides end-to-end "pay-and-upload" scripts that accept an EVM private key (EVM_PRIVATE_KEY) or Coinbase CDP credentials, and uses x402-fetch to sign an EIP-3009 USDC transfer (transferWithAuthorization). It integrates with Coinbase CDP (CdpClient) or raw wallet signers and executes the payment flow (wrapFetchWithPayment / pay-and-upload), so the skill is specifically designed to move money on-chain. This is Direct Financial Execution.