open-money-agent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow consumes external text through x402 paid services and email inboxes (e.g., AgentMail and Resend proxies) where outsider-authored messages can be read by the agent.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents direct financial operations including buying, selling, swapping, and bridging tokens, sending funds, paying for web services (x402), earning yield, and participating in Polymarket predictions (SKILL.md:4-8, 71-75). These direct transfer and payment routes operate under user sign-in and spending allowances, but authentication/authorization is handled via user sign-in and session keys/allowances managed by the agent/CLI rather than an independent service-layer access check that prevents the agent from executing transactions within its granted allowance (SKILL.md:13, 36). Therefore, direct financial operations are present without independent access control.