sparklend-plugin

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's auto-injected pre-flight install fetches and executes remote installer code at runtime (sh "$ONCHAINOS_TMP/install.sh") from the URL pattern https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh — a required installer for onchainos and thus a runtime remote code execution dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto lending/borrowing plugin that performs on-chain financial actions. It exposes specific commands that create and broadcast transactions (supply, borrow, repay, withdraw) and handles ERC‑20 approvals and Pool.supply()/borrow()/repay() calls. It requires a wallet (onchainos wallet login/addresses) and can broadcast transactions when the user passes --confirm. These are direct crypto/blockchain financial execution capabilities (wallet signing, token approvals, transaction submission), not generic tooling.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)