eth-to-sol

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires calling the remote Solana Developer MCP autofixer during runtime ("not optional") and describes looping on calls to https://mcp.solana.com/mcp/rust_autofixer (referenced as https://mcp.solana.com/mcp), which is a runtime external service that executes fixes on submitted Rust source and thus can directly change agent-applied code/instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly about translating Ethereum/Solidity contracts to Solana programs and repeatedly references SPL Token, CPIs (cross-program invocations), token::transfer, ATA creation, lamports, transaction construction, and client/API integration for token movement. Those are specific crypto/blockchain transaction capabilities (constructing and invoking token transfers and related transactions), not generic tooling, so this grants direct financial execution authority.