t2000-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs installing an npm package (@t2000/cli), which is distributed via the public npm registry without an immutable URL locator or cryptographic hash, constituting an unverifiable common/reputable unofficial operational dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents and sets up a non-custodial local CLI wallet and MCP server (t2000) capable of direct financial operations such as sending, swapping, and paying (t2 send, t2 swap, t2 pay, t2000_pay). While local spending limits can be configured via CLI (t2 limit set), these file/config limits are enforced locally by the SDK/CLI rather than by an independent service-layer or execution-layer authentication check for direct monetary transfers. Therefore, direct financial operations are present without established independent access control.