layerzero-value-transfer

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime calls to the LayerZero API (e.g. https://transfer.layerzero-api.com/v1/quotes) which return "userSteps" (ready-to-send transaction calldata) that directly control what the agent signs and executes, so the external URL is a runtime dependency that controls agent actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto value-transfer API. It describes moving assets across 150+ blockchains, obtaining quotes, building and executing userSteps (ready-to-send transaction calldata), signing EIP-712 payloads, submitting signatures, and sending/sending-signed transactions with an agent wallet. Endpoints and code samples show direct transaction execution and signature submission, so this is a tool specifically designed to move funds on-chain.