swapwallet

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent or client to load an external Model Context Protocol server from https://swapwallet.app/mcp, which has unknown, arbitrary, or third-party publisher provenance.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill provides direct financial operations including swaps, transfers, and crypto/fiat withdrawals via request tools (request_swap, request_transfer, request_crypto_withdraw, request_fiat_withdraw). These operations are authenticated and authorized via OAuth user sign-in and require independent approval by the user via Telegram, establishing qualifying independent access control.