meteora

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill contains code examples that assign an API key string (JUPITER_API_KEY = 'your-api-key') and a literal secret key placeholder (Keypair.fromSecretKey(/* your secret key */)), which encourages embedding secrets verbatim in generated code/commands and therefore could require the LLM to handle/output secret values directly.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL.md describes explicit DeFi SDK methods that create and send on-chain financial transactions (e.g., swap(), buy(), sell(), deposit(), withdraw(), fundReward(), stake(), zap.*) and shows examples of constructing/signing/sending transactions (sendAndConfirmTransaction, Keypair.fromSecretKey, Wallet). These are specific financial execution operations (swaps, liquidity deposits/withdrawals, staking, presale deposits, pool creation, etc.), not generic tooling — therefore the skill grants direct financial execution capability.