sanctum

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt embeds and demonstrates using an API key directly in request URLs (e.g., query parameters and string interpolation like ?apiKey=${API_KEY} / this.apiKey), which encourages including secret values verbatim in generated requests or code and therefore risks secret exfiltration.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes cryptocurrency trading and staking APIs and client code that create, sign, and submit on-chain transactions. It documents endpoints such as GET /swap/token/order (returns a Base64 tx) and POST /swap/token/execute (accepts signedTx), plus deposit/withdraw stake endpoints. The TypeScript client decodes, signs (with a Keypair), and posts signed transactions (executeSwap / swapLst), and usage examples perform swaps, staking, unstaking, and liquidity operations. These are specific crypto/blockchain financial execution capabilities (moving funds and executing market/staking operations).