Most static findings are Markdown, placeholder, or documentation matches and are false positives. The two request examples intentionally contact a user-selected endpoint and can handle payment challenges. The documented CLI can create wallets and issue paid requests, so payment actions require explicit user review.
The documented CLI can create a wallet and make a paid request. These actions can create financial consequences when run against a real endpoint or funded account.
The CLI section explicitly describes wallet creation and making a paid request. This is intended payment functionality, not evidence of unauthorized activity.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
const res = await fetch('https://api.example.com/resource')
The example deliberately sends a request to a user-selected endpoint through a payment-aware client. A 402 response can initiate a payment flow, so users must control the target and account.
const res = await mppx.fetch('https://api.example.com/resource')
The example deliberately sends a request to a user-selected endpoint through a payment-aware client. A 402 response can initiate a payment flow, so users must control the target and account.
Most scanner alerts are false positives from Markdown backticks, code fences, documentation links, and safe environment-variable guidance. The main confirmed issue is an inline private-key placeholder that could encourage unsafe wallet-key handling if copied. The CLI examples also need explicit consent guardrails before wallet creation or paid requests.
The server example passes an inline private-key placeholder to privateKeyToAccount. Although placeholder text is used, copying this pattern can lead to real wallet keys in source or prompts.
The CLI section includes wallet creation and a command labeled make paid request. Agents need explicit user approval before running commands that create wallets or spend funds.
Lines 112 through 116 describe the mppx CLI and include wallet creation plus a paid request command. The risk is contextual because the text is documentation, but the financial action is explicit.