marginfi

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The guide's initialization snippet uses Keypair.fromSecretKey(/* your secret key */), which encourages embedding a raw wallet private key into source code (or into generated output), requiring the LLM to handle or output secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a specialized SDK for a Solana lending protocol (Marginfi) and explicitly exposes functions that execute on-chain financial operations: creating accounts with a NodeWallet/Keypair (signing authority), deposit, borrow, repay, withdraw, flash loans, looping (leverage), and low-level instruction builders. These are specific crypto/blockchain financial execution capabilities (sending transactions, interacting with wallets), so it grants Direct Financial Execution Authority.