nft

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most of the links are official documentation and reputable sites (OpenZeppelin, Node.js, Midnight docs, GitHub OpenZeppelin repo, and a metadata JSON) but the direct download of compact-installer.sh from github.com/midnightntwrk (and the curl | sh installation pattern) is a high-risk distribution vector unless you verify the maintainer and inspect the script first, so the bundle contains a potentially malicious download source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installation instructions include a runtime command that fetches and pipes a remote script to the shell—curl --proto '=https' --tlsv1.2 -sSf https://github.com/midnightntwrk/compact/releases/latest/download/compact-installer.sh | sh—which downloads and executes remote code and is required for the skill.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides on-chain token operations and APIs for creating and moving crypto assets: mint/transfer circuits, shielded transfer logic requiring wallet signatures, native Midnight token functions (shielded/unshielded), and TypeScript examples using deployContract and deployed.callTx.mint. Those are concrete blockchain wallet/transaction operations (signing, minting, transferring ownership/commitments), so it grants direct crypto financial execution capabilities.