Security audit
Security checks for vulnerabilities and agentic risk
This skill helps with real crypto payouts, but its behavior is disclosed and it repeatedly requires validation and user confirmation before funds move.
Install only if you intend to let an agent help prepare Bankr-funded Spraay payouts. Treat it like any real-money workflow: verify token, chain, recipient addresses, amounts, fees, and transaction details yourself before confirming execution, and keep the Bankr API key limited to Bankr use.
The trigger phrase "batch send" is overly generic and can match many unrelated user intents, causing this high-impact financial skill to activate outside the intended Bankr/Spraay context. Because the skill can lead to token transfers and payroll-like actions, accidental invocation increases the chance of misrouting users into a funds-moving workflow without sufficient contextual fit.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
3. Validate → estimate → execute the batch (same free-then-paid flow as
Recipe 1). USDC or the fee token itself both work.
4. For recurring splits, re-run on a schedule the user controls; never
auto-execute without a standing, explicit instruction.
## Recipe 3 — Treasury → Payroll
No suspicious patterns detected.