example-private-party-dapp

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The 1am.dev and localhost links are benign (official wallet and a local dev asset), but the GitHub Releases URL points to a downloadable .sh installer that the skill pipes to sh — executing remote shell scripts directly is a high-risk distribution pattern and can deliver malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs running a remote installer via shell-piped curl (https://github.com/midnightntwrk/compact/releases/latest/download/compact-installer.sh) and also suggests cloning a Git repo (git@github.com:midnightntwrk/example-private-party.git) which fetch remote code that is then executed locally, so these are runtime external dependencies that can execute code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly implements on-chain token transfer operations (unshielded NIGHT): contract circuits call receiveUnshielded(...) on check-in and sendUnshielded(...) in claimFees, and the frontend/provider code submits transactions via wallet-connected providers. These are specific crypto financial execution primitives (wallet addresses, unshielded token transfers), so the skill grants direct financial execution authority.