dflow-platform-fees

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly instructs the agent to ask about and "plumb" a DFlow API key into HTTP client usage (x-api-key), which implies the LLM may need to receive and embed the secret verbatim in requests or generated scripts — a direct secret-handling/exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly about collecting platform fees on trades via the DFlow Trade API. It defines API parameters (platformFeeBps, platformFeeScale, platformFeeMode, feeAccount), requires a builder-controlled SPL token account/ATA to receive fees, and states DFlow will transfer the fee to that feeAccount on successful execution. This is a specific, built-in mechanism to move money/tokens (financial execution), not just a generic API or browser automation capability.