near-kit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains examples that embed private keys and seed phrases as string literals (e.g., privateKey: "ed25519:..." and parseSeedPhrase("...")), which encourages placing secrets verbatim into generated code and thus requires the LLM to handle/output secret values directly.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a NEAR blockchain SDK with built-in signing, key management, and transaction APIs that move value: it accepts privateKey/defaultSignerId, exposes near.send(...), contract.call.transfer(...), a transaction builder with .transfer(...).send(), and key stores/rotating key lists. These are specific crypto/blockchain wallet and transaction functions that can create and sign transfers, so it grants direct financial execution authority.