aptos

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains examples that embed or print private keys and a CLI invocation that accepts a private-key argument, which would require the model or user to place secret key material verbatim into commands/code (high exfiltration risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Quick Start includes a direct remote-code execution command that downloads and pipes a script to the Python interpreter (curl -fsSL "https://aptos.dev/scripts/install_cli.py" | python3), which fetches and executes external code at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This SKILL.md explicitly describes and demonstrates blockchain financial operations: minting/burning coins, depositing/withdrawing coins, transferring APT via signed transactions, funding accounts, and building/signing/submitting transactions (including multi-agent transactions and using signer capabilities). These are concrete crypto/blockchain transaction APIs and wallet signing operations (directly moving value), not generic tooling.