near-smart-contracts

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The SKILL.md contains curl ... | sh installer commands that fetch and execute remote scripts at runtime from https://sh.rustup.rs, https://github.com/near/cargo-near/releases/latest/download/cargo-near-installer.sh, and https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh, which are runtime-executed external dependencies.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes blockchain transaction and signing capabilities: commands to create accounts, autogenerate keypairs, sign-with-keychain and send deployments (SKILL.md:83-91); references to building and sending multi-chain transactions (omni-transaction-rs) (SKILL.md:232-232); and “chain-signatures” functionality to derive addresses, request MPC signatures, and sign transactions for other chains (SKILL.md:157-159, SKILL.md:248-248). These are specific crypto/transaction tools (wallet/key management, transaction building and signing), which constitute direct financial execution authority.