onchain-pay-open-api

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to read or ask for API_KEY and PEM_PATH and embed them directly as command-line arguments in the provided bash invocation (and to insert API keys into JSON bodies), which requires the LLM to output secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to perform financial operations: it integrates with Binance Onchain Pay to create buy orders (pre-order), obtain real-time quotes, select payment methods, and send crypto from a Binance account to external wallet addresses. It includes endpoints and parameters for fiat-to-crypto purchases, direct transfers (SEND_PRIMARY), merchant payment processing, cross-chain transfers, and on-chain smart-contract execution (ON_CHAIN_PROXY_MODE). It also describes the signing and execution flow for calling these APIs with credentials. These are specific, explicit money-moving capabilities (payment gateway / crypto transfers), not generic tooling.