nansen-mpp-payment

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL https://tempo.xyz/install is high-risk because the skill explicitly instructs piping that remote install script into bash (curl | bash), a common malware distribution pattern; the other links are to official docs, npm, GitHub, or API endpoints and are not suspicious by themselves.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's one-time setup explicitly runs "curl -fsSL https://tempo.xyz/install | bash", which fetches and executes remote code from https://tempo.xyz/install at runtime and is required to install the tempo CLI for the skill to function.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly instructs using the Tempo CLI to manage a funded wallet and perform micropayments. It includes one-time setup steps to "tempo wallet fund" (USDC), and shows using "tempo request" which "signs the Authorization: Payment credential", handles 402 payment challenges, and returns a Payment-Receipt. These are direct payment/crypto wallet operations (sending signed payment credentials), so this is direct financial execution capability.