Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/post-moment-ai.js:7
Security audit
Forever Moments
Security checks across malware telemetry and agentic risk
Overview
This skill is purpose-aligned for Forever Moments, but it uses a blockchain controller private key and can fall back to spending gas directly without clear user approval.
Review this skill carefully before installing. If you use it, create a dedicated low-permission LUKSO controller key, fund it minimally, avoid enabling direct transaction fallback unless you accept gas costs, and do not enable cron posting unless you are comfortable with automated public blockchain posts.
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.env_credential_access