x2c-publish

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly asks users to paste their X2C API Key into the chat, instructs the agent to use that key verbatim in curl headers and to save it to credentials/{USER_ID}.json, which requires the LLM to handle and output secret values directly (high exfiltration risk).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes wallet and token transfer operations. It documents API calls for wallet/balance, wallet/claim-x2c (claim on‑chain tokens), wallet/swap-x2c (swap X2C → USDC), and wallet/withdraw-usdc (withdraw USDC to an external Solana address with amount and to_address parameters). The agent is instructed to store and use a user-provided API key to call these endpoints, including actions that move tokens off‑platform. These are specific crypto/financial operations (token claims, swaps, and withdrawals), not generic tooling, so the skill grants direct financial execution capability.