Most static findings are Markdown-formatting false positives, including command-name backticks, repository-relative reference paths, payment-link identifiers, and the documented Portal endpoint. The skill genuinely handles wallet private keys and can initiate direct on-chain payments, creating a high-impact financial and credential-handling risk that requires explicit user confirmation.
The skill documents a command that sends a direct on-chain payment for an existing payment link. A mistaken or malicious payment-link identifier can cause an irreversible transfer when a wallet private key is supplied.
The command index explicitly states that pay-payment-link sends a direct on-chain payment, and the reference shows it accepting a private key. Blockchain transfers generally cannot be reversed.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The workflow accepts a wallet private key through an environment variable for direct on-chain payments. Exposure or misuse of this credential can authorize transfers from the wallet.
The workflow accepts a wallet private key through an environment variable for direct on-chain payments. Exposure or misuse of this credential can authorize transfers from the wallet.
- `ALTLLM_WALLET_PRIVATE_KEY=<private-key>` with the default `--private-key-env ALTLLM_WALLET_PRIVAT
The workflow accepts a wallet private key through an environment variable for direct on-chain payments. Exposure or misuse of this credential can authorize transfers from the wallet.
The static external-command and system-reconnaissance alerts are mostly Markdown false positives. Real risk remains high because the skill handles wallet private keys, can initiate direct cryptocurrency payments, calls an external payment API, and references shared files outside the skill directory.
The reference documents raw private-key input through a command-line argument. The same note states that arguments can leak through history and process listings.
The unsafe argument flag and leakage warning are explicitly documented in the reference. This is a clear secret-exposure path.
Capability review items (12)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The workflow requires a wallet private key environment variable for direct payments. Handling a signing key is a real high-impact secret risk, even though the example uses a placeholder.
The workflow requires a wallet private key environment variable for direct payments. Handling a signing key is a real high-impact secret risk, even though the example uses a placeholder.
- `ALTLLM_WALLET_PRIVATE_KEY=<private-key>` with the default `--private-key-env ALTLLM_WALLET_PRIVAT
The workflow requires a wallet private key environment variable for direct payments. Handling a signing key is a real high-impact secret risk, even though the example uses a placeholder.
The skill instructs the agent to read ../_shared files outside the skill directory. That can pull unscanned instructions into execution, so it is a filesystem boundary risk.
The skill instructs the agent to read ../_shared files outside the skill directory. That can pull unscanned instructions into execution, so it is a filesystem boundary risk.
The reference instructs the CLI to call https://platform-api.altllm.ai for payment workflows. This is an intended external network dependency, but it handles payment data.