birdeye-plugin

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's auto-injected install step downloads and installs remote code at runtime from https://github.com/okx/plugin-store/releases/download/plugins/birdeye-plugin@0.1.0/birdeye-plugin-runtime.tgz (and its checksums.txt) and then runs npm install on that package, so the URL is used at runtime to fetch and execute required remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports an "x402" pay-per-request mode that performs USDC payments on Solana. It requires a Solana private key file (~/.birdeye/key), instructs the agent how to enable x402 mode, and documents a signer subprocess that loads the private key and "signs USDC payments per request" (with enforced daily caps). Those are explicit crypto transaction signing / payment capabilities (direct financial execution), not generic tooling.