Account Abstraction Paymaster

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes examples and installation steps that instruct users to place private keys/API secrets directly into environment variables and code (e.g., export BUNDLER_PRIVATE_KEY / owner_private_key="0x..."), which would require an agent to handle or emit secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to construct, sign, sponsor, and submit on-chain value transfers and paymaster deposits. It exposes concrete functions and usage for building ETH and ERC-20 transfer UserOperations, encoding swap calls, submitting UserOps to an EntryPoint (handleOps), and depositing ETH to the EntryPoint. It also documents private keys / owner signing keys and examples that perform deposits and execute transactions. These are specific crypto/transactional operations (wallet signing, sending funds, depositing, and invoking swaps), i.e. direct financial execution.