cli-cast

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill executes a script (scripts/rabby-slow-gas.sh) during runtime setup/simulation that performs an inbound curl fetch from https://api.rabby.io/v2/wallet/gas_market to obtain behavior-selecting fee configuration, representing an unofficial operational dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates a direct financial workflow using Foundry cast to sign and broadcast blockchain transactions, execute token transfers, manage deposits, and submit financial instructions on EVM-compatible chains. It lacks independent access control: while it mentions user reviews, confirmation prompts, and wallet interactions, there is no service-enforced independent authentication or authorization mechanism documented for the direct transaction signing and broadcast route.