squads

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The document contains code examples that embed secret material into requests or code (e.g., Authorization: Bearer ${apiKey}, Authorization: Bearer ${accessToken}, Keypair.fromSecretKey(/* your secret key */) and an OTP example), which would require an agent to handle or output secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation defines explicit financial APIs and SDK calls that create and execute real money transfers: multisig vault transaction creation and vaultTransactionExecute, spending-limit creation and spendingLimitUse, Smart Account session keys with "transfer"/"swap" permissions and direct-debit/subscription features, and Grid REST endpoints for payments and standing orders. These are specific tools to move funds (on-chain transfers and off-chain payment operations), not generic utilities.