polygon

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL includes a setup command that downloads and immediately executes a remote install script via "curl -L https://foundry.paradigm.xyz | bash", which fetches and runs remote code during setup.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill contains explicit crypto transaction and wallet operations: it instructs storing a PRIVATE_KEY, shows deployment commands using --private-key and --broadcast, Hardhat accounts using PRIVATE_KEY, and viem examples that create wallet/clients and call contract functions that move funds (e.g., migrate(), staking buy/sell/restake, depositFor/exit, bridgeAsset, claimAsset). These are specific, purpose-built blockchain financial operations (signing and sending transactions, bridging, staking, token migration), so it grants direct financial execution capability.