cardano-offchain

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches from public APIs (see apiFetch in SKILL.md / examples/api-failover.md which calls https://api.adavault.com and api2), and it consumes untrusted wallet-provided data via the CIP-30 flow (window.cardano.enable(), api.getUtxos()/getBalance() shown in SKILL.md and examples/ada-handle.md), both of which are runtime, third-party inputs that the agent is expected to parse and that can materially affect actions like network gating, delegation, and transaction building.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed for Cardano blockchain financial operations. It documents CIP-30 wallet integration, transaction construction via MeshJS (e.g., tx.sendLovelace(), tx.build()), wallet signing and submission functions (api.signTx, api.submitTx, wallet.signTx(), wallet.submitTx()), delegation and stake operations, and handling UTxOs/ADA balances. These are specific crypto wallet and transaction APIs intended to create, sign, and submit monetary transactions (move ADA), not generic tooling. Therefore it grants direct financial execution capability.