walrus-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes an installation command that fetches and executes remote code at runtime: "curl -sSfL https://raw.githubusercontent.com/Mystenlabs/suiup/main/install.sh | sh", which installs required tooling for the CLI.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The Walrus CLI skill explicitly interacts with a blockchain and wallet: it requires/uses SUI and WAL tokens for write operations, exposes a --wallet option, has a --gas-budget to set SUI to spend, and describes errors like "Cannot find gas coin for signer address" and reuse vs buying storage resources. Store/delete/burn operations imply on-chain transactions that spend tokens. These are specific crypto/blockchain execution capabilities (wallet signing and spending), not merely generic tooling.