starknet

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README contains explicit curl | sh installer commands that fetch and execute remote scripts at https://docs.swmansion.com/scarb/install.sh, https://raw.githubusercontent.com/foundry-rs/starknet-foundry/master/scripts/install.sh, and https://get.starkli.sh, which are runtime actions that execute remote code during setup.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a StarkNet development guide and explicitly includes tooling and code to create accounts with private keys, sign and send on-chain transactions, deploy/declare contracts with account keystores, invoke state-changing contract functions, perform multicall (account.execute) including token approvals and swaps, and wait for transaction confirmation. These are concrete crypto/blockchain transaction and signing capabilities (wallet/account setup, transaction submission, multicall/swaps), i.e. direct financial execution on a blockchain.