midnightskill

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This bundle includes a direct download of a shell installer script from a GitHub release (curl … | sh), which is a high-risk pattern because it fetches and executes remote code without inspection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skills include a direct install command that downloads and pipes a remote shell script to sh (https://github.com/midnightntwrk/compact/releases/latest/download/compact-installer.sh), which executes remote code at setup time and is required for the Compact compiler used by the skills.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly documents wallet integration and blockchain transaction functionality: integrating the 1AM wallet, a privacy-preserving payment vault with deposit/withdraw of tNIGHT, wallet SDKs (HDWallet/WalletFacade/Shielded/Unshielded/Dust), and shielded/unshielded token transfers. These are concrete crypto wallet and token-transfer operations that enable sending/signing transactions and moving value, so this grants direct financial execution capability.