midnight-js

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill uses a runtime proof server endpoint (e.g., http://127.0.0.1:6300) — and even instructs pulling/running the container midnightntwrk/proof-server:latest — which the SDK calls via httpClientProofProvider to execute remote proof-generation code that the skill depends on.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly a blockchain wallet / DApp SDK with direct transaction and key management APIs. It exposes HD wallet seed generation and restoration (generateRandomSeed, HDWallet.fromSeed), secret key objects (ZswapSecretKeys, DustSecretKey), wallet types (ShieldedWallet, UnshieldedWallet, DustWallet, WalletFacade), and functions that build, sign, finalize and submit on‑chain transactions (wallet.balanceUnboundTransaction, wallet.finalizeRecipe, wallet.submitTransaction, registerNightUtxosForDustGeneration, deployContract, deployed.callTx.increment(), signTransactionIntents, etc.). Those calls directly create, sign and broadcast ledger transactions and manage private keys — i.e., direct crypto/blockchain financial execution capability.