create-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The create-skill workflow ingests the outsider-provided ${var} (end-user free text) and then uses it to drive research steps including WebSearch/WebFetch for external documentation, meaning it can cause the agent to fetch and read free text content originating from arbitrary pages.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly permits irreversible side-effects including "spend" and "on-chain writes" to be executed "in-run" via ./secretcurl with injected secrets. That describes an explicit mechanism for executing blockchain transactions / financial actions (signing/sending on-chain writes and performing spend) rather than mere generic browsing or data-fetching, so it grants direct financial execution capability.