agent-payment-x402

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs "npx agentwallet-sdk@6.0.0" (MCP config and TypeScript example), which fetches and executes remote npm package code at runtime — see https://www.npmjs.com/package/agentwallet-sdk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payment execution integration: it describes the x402 payment protocol, non-custodial wallets and signing of transactions, and exposes agent-callable payment tools (e.g., send_payment, get_balance). It references payment SDKs (agentwallet-sdk, OKX payments), shows MCP config to run a payment server with private keys, and example code that requires a WALLET_PRIVATE_KEY — all indicating direct financial execution capability.