one

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires including API/connection keys in CLI commands and config operations (e.g., passing a connectionKey to actions execute and examples like mem config set embedding.apiKey sk-... or export OPENAI_API_KEY=sk-...), which forces the LLM to handle and emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The documentation describes several powerful primitives that would enable deliberate malicious activity (data exfiltration and remote code execution) if a flow or relay were authored with hostile intent — notably file-read/file-write, $.env access, code.module (full Node APIs incl. fs/child_process/network), bash steps (arbitrary shell with --allow-bash), and webhook relay/url/passthrough forwarding to arbitrary endpoints; these are high-risk capabilities that must be treated as potential abuse vectors.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes connectors and actions for payment platforms — e.g., multiple Stripe examples ("one --agent sync init stripe balanceTransactions", "one --agent sync run stripe", "one --agent sync query stripe/balanceTransactions") and a generic actions execute surface capable of calling platform-specific actions (one --agent actions execute ). This is not merely a generic browser or HTTP tool: it includes explicit Stripe integration (a payment gateway) and an execution API that can perform platform actions. That constitutes direct financial execution capability.