hyperlane

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples that pass private keys on the command line (e.g., --key $PRIVATE_KEY / $VALIDATOR_PRIVATE_KEY), which teaches an insecure pattern that exposes secrets via process arguments and would encourage the LLM to emit commands that could contain verbatim secret values.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation contains explicit, blockchain financial execution APIs and examples: it shows private-key-based account/wallet setup, contract calls that approve ERC-20 tokens, invoke warp route transferRemote (cross-chain token transfers), and use Interchain Accounts (ICA) to execute remote transactions (including token transfers). It also demonstrates signing and sending transactions via walletClient.writeContract. These are specific crypto/transaction primitives that enable moving value, so this grants Direct Financial Execution authority.