blockchain-web3

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes code examples that embed secrets directly (e.g., a private key passed to privateKeyToAccount and an RPC URL with an inlined Alchemy key), which would require the model or user to insert secret values verbatim—an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes code and APIs for creating wallet clients (privateKeyToAccount), signing and sending blockchain transactions, writing contracts, useSendTransaction/writeContract examples that programmatically transfer ETH/tokens, and account-abstraction flows (smartClient.sendTransaction, session keys with value limits). These are specific crypto/blockchain execution capabilities that can move funds (send transactions / sign transactions), so it grants Direct Financial Execution Authority.