@3182/cross-chain-bridge

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The script calls the LiFi API at runtime (https://li.quest/v1/quote) and uses the returned "transactionRequest" fields (tr["to"], tr["data"]) to construct and broadcast on-chain transactions, meaning remote content directly controls the agent's outbound actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a cross-chain token bridge: it includes single-command examples to move USDC/USDT between chains, creates an Alchemy SmartAccount, auto-approves token spending, and executes the bridge via the Across Protocol (reporting transaction hashes). These are concrete, purpose-built actions to transfer on-chain funds (send transactions, approve spender, perform cross-chain swap), so it grants direct financial execution authority.