trade

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes remote code at runtime via "npx fibx@latest" (which fetches/executes the fibx package from the npm registry, e.g. https://registry.npmjs.org/fibx), so external code is downloaded and executed and is required for the skill to run.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto token swap tool: it finds routes, handles ERC-20 approvals, simulates and executes swaps, performs wrap/unwrap via contract calls, and verifies transactions (tx-status). It provides concrete CLI commands to send on‑chain transactions (npx fibx trade) and requires wallet/session and balances. This is a specific blockchain financial execution capability (crypto/wallet/transaction signing and sending), so it qualifies as Direct Financial Execution.