fourmeme-plugin

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's auto-injected pre-flight installs run at runtime and explicitly downloads+executes a remote installer script from raw.githubusercontent.com (https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh), meaning fetched content is executed as code during startup.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides crypto/blockchain transaction capabilities: commands like buy, sell, send, create-token and agent-register perform on-chain writes (via onchainos wallet contract-call), transfer BNB/ERC‑20, submit msg.value, and broadcast signed transactions. It uses wallet signing (TEE-backed), pre-flight balance/gas checks, and TX polling — i.e. the plugin's primary purpose includes executing financial (on‑chain) transactions. This matches "Crypto/Blockchain (Wallets, Swaps, Signing)" and "Market Orders" in the Direct Financial Execution rule set.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)