raydium

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The guide's example shows embedding a private key literal via Keypair.fromSecretKey(bs58.decode('YOUR_SECRET_KEY')), which requires the LLM/user to include secret key values verbatim in code/output and therefore poses an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL.md is a concrete integration guide for a crypto exchange/AMM (Raydium) and includes SDK and HTTP Trade API calls for creating and signing on-chain transactions. It shows loading an owner Keypair from a secret key, functions that build and execute swaps/add liquidity/create-pool/LaunchLab transactions, and examples calling execute({ sendAndConfirm: true }) — i.e., code to sign and submit transactions that move crypto assets. This is explicitly direct financial execution (crypto/blockchain transaction signing and submission).