edge

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's Quickstart and examples explicitly show embedding an API secret in URLs and headers (e.g., ?secret=YOUR_SECRET, X-ERPC-Secret-Token: YOUR_SECRET) which instructs including secrets verbatim in commands and could lead the agent to output real keys.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a managed EVM JSON-RPC service and exposes crypto transaction methods and payment settlement. It lists supported RPC methods including eth_sendRawTransaction (ability to submit signed transactions to move tokens/ether) and describes an x402 pay-per-request flow where a client "signs a USDC payment" on Base (chain 8453) to settle requests. Those are specific crypto/blockchain transaction and payment capabilities — not generic tooling — so this grants direct financial execution authority.