viem

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt demonstrates and encourages embedding secrets verbatim in code (e.g., RPC URL with YOUR_KEY and privateKeyToAccount("0x...")), which would require the LLM to handle or output API keys/private keys directly.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto/blockchain SDK with wallet and transaction APIs. It includes privateKeyToAccount, createWalletClient, walletClient.sendTransaction, walletClient.writeContract (e.g., ERC-20 transfer), and utilities like parseEther/formatEther. These functions allow signing and broadcasting transactions and transferring ETH/tokens — i.e., directly moving value on-chain. This matches the Crypto/Blockchain category of Direct Financial Execution.