kora-operator

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples and commands that place secrets (KORA_PRIVATE_KEY, API keys, HMAC/reCAPTCHA secrets, JUPITER_API_KEY) directly in env vars and CLI flags (e.g., docker -e KORA_PRIVATE_KEY=), which could cause an agent to request and then embed secret values verbatim in generated output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the Kora runtime, the required workflow is an RPC server that ingests signing requests from connected clients (outsider-authored free text in the RPC request bodies/parameters), since text inputs like transaction payloads and fields such as user_id are read to service signing/fee-estimation methods.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for operating a Solana "Kora" node that validates, signs, and sponsors transactions, manages signer private keys, and initializes payment token accounts. It references signer configuration with a private-key env var, commands to start the RPC signing server and initialize payment ATAs, and fee-payer policies (allow_transfer) that control on-chain transfers — all of which are direct crypto/transaction execution capabilities.