zksync

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes literal private keys in examples and instructs passing private keys on the command line (e.g., --private-key $PRIVATE_KEY) and embedding PRIVATE_KEY into code (process.env.PRIVATE_KEY), which requires handling secret values verbatim and is high-risk for secret exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill contains installation commands that fetch and execute remote code at runtime — specifically curl -L https://raw.githubusercontent.com/matter-labs/foundry-zksync/main/install-foundry-zksync | bash and cargo install --git https://github.com/matter-labs/era-test-node which download and run external scripts/repos during setup.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged literal, high-entropy Ethereum private keys present in the documentation. These are 0x-prefixed 64+ hex-character values that can be used to control the corresponding accounts — therefore they meet the secret definition (private keys). I did not treat them as placeholders or simple setup passwords because they are random-looking keys (not "YOUR_API_KEY", "password", or other low-entropy examples). No potential matches were ignored.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly about zkSync blockchain development and includes concrete wallet and SDK calls that move funds: creating wallets from a PRIVATE_KEY, wallet.sendTransaction examples (including paymaster flows), and high-level bridging methods wallet.deposit and wallet.withdraw (with finalize). These are specific crypto/blockchain operations that can sign and send transactions and transfer funds — i.e., direct financial execution capability.