example-locker-dapp

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The set includes an executable installer script served directly from a GitHub release (compact-installer.sh) and a local-hosted .prover asset (potentially a binary/WASM) which are high-risk to run without verification, while 1am.dev appears to be an official wallet site and is low risk — treat the script and localhost asset as potentially unsafe unless you verify signatures/source and inspect the script before executing.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The prerequisite instructs running a remote installer via curl -sSf https://github.com/midnightntwrk/compact/releases/latest/download/compact-installer.sh | sh which fetches and executes remote code at setup/runtime and is required for the skill (compact compiler), so it poses a high risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto token locker dApp that deploys contracts and performs on-chain token transfers. The contract contains a release circuit that calls sendUnshielded to transfer tokens to a recipient after unlock time, and the witness/private state holds the beneficiary secret key used to prove release authority. The TypeScript library exposes deployLocker, lockTokens, and releaseTokens which call createUnprovenDeployTx / submitCallTxAsync (submitTxAsync) to create and submit transactions. The frontend triggers those functions via wallet connection (1AM wallet) to lock and to release funds.

These are concrete, specific financial-execution capabilities: interacting with a blockchain wallet and submitting transactions that move crypto (NIGHT/Stars), managing beneficiary secret keys, and sending unshielded tokens. Under the policy, this is a Direct Financial Execution tool (crypto/blockchain wallet + send transaction).