make-git-escrow

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill tells the agent to check a .env for PRIVATE_KEY and even suggests running a CLI with --privateKey "0x..." (embedding a raw private key), which requires reading/including secrets verbatim and thus poses a direct exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to initiate on-chain escrows and lock ERC20 tokens via a CLI. It references supplying a PRIVATE_KEY, network, and running git-escrows submit with parameters including --reward and --token, which will create/submit an on-chain escrow that moves/locks tokens. This is a specific crypto/blockchain financial execution capability (signing/sending transactions), not a generic tool.