multinetwork

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime setup commands that fetch and execute remote code — notably "git clone https://github.com/midnightntwrk/midnight-local-dev" followed by npm start and Docker commands that pull/run images (midnightntwrk/midnight-node, midnightntwrk/indexer-standalone, midnightntwrk/proof-server) — so external content is downloaded and executed as part of running the skill.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found a literal wallet seed in the docs that can be used to initialize the genesis master wallet:
• Location: Section "2) Local Docker Stack (undeployed)" — "Genesis master wallet seed: 0x0000000000000000000000000000000000000000000000000000000000000001".

This value is a directly present seed/secret that grants access to the genesis/master wallet in the local/dev environment. Even though it is low-entropy and clearly intended for local/test use, it is a usable credential and therefore should be treated as a secret in secret-scanning terms.

Other mentions that look like credentials (e.g., "X-API-Key: pk_live_xxx" or truncated addresses like "09dbe05f...") are placeholders or redactions and are ignored per the rules.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). Yes — this skill explicitly provides blockchain wallet and transaction APIs that can move value. It includes code and scripts to fund genesis/test accounts, derive wallet keys, register NIGHT UTXOs for DUST generation, build headless wallets, create/sign/balance transactions, finalize recipes, and submit transactions. Examples:
• Funding / genesis wallet and funding CLI (midnight-local-dev) and npm scripts like deploy:mainnet / deploy:preview (explicit deploy/funding actions).
• buildHeadlessWallet exports seedHex and unshieldedAddress and wires ShieldedWallet, UnshieldedWallet, DustWallet.
• ensureDust calls walletFacade.registerNightUtxosForDustGeneration and then walletFacade.finalizeRecipe + walletFacade.submitTransaction.
• makeWalletAndMidnightProvider exposes balanceTx and submitTx which call walletFacade.balanceUnboundTransaction, finalizeRecipe, and submitTransaction; signTransactionIntents signs transaction intents.
• WalletFacade.start/ state sync and submitting transactions against network RPC/proofServer.

These are specific crypto/blockchain transaction capabilities (wallet management, signing, registering UTXOs, submitting transactions), i.e. direct financial execution authority over NIGHT/DUST assets.