aomi-transact

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly advises running the CLI on-demand via npx (e.g., "npx @aomi-labs/client@0.1.30 ...") and links to the npm package https://www.npmjs.com/package/@aomi-labs/client, which indicates fetching and executing remote code at runtime from that URL.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly performs crypto financial actions: it builds, simulates, queues, signs, and broadcasts on-chain transactions (e.g., swaps, staking, bridging). It references the specific signing command (aomi tx sign), queued tx ids (tx-N), and examples of swaps, stakes and cross-chain bridges — i.e., concrete wallet signing and transaction broadcasting functionality. This is direct financial execution (crypto/blockchain signing and broadcasting).