agentprivacy-swordsman-browser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The provided SKILL.md describes a browser agent that “reads the site’s tracking intent” and negotiates/enforces MyTerms when visiting sites, which implies runtime ingestion of outsider-authored web page content (public site text/metadata) into the agent’s LLM context via the browsing/cookie-slashing/MyTerms negotiation path.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes Layer 5 "Privacy pools (x402 Protocol)" with "Anonymous transactions without intermediaries. ZK proofs of compliance. Non-custodial." and Dragon Armor including "Privacy pool access with wallet integration" and "autonomous commerce with capital" where "the Mage fully activates." These statements indicate built-in crypto/blockchain financial capabilities (wallet integration, non-custodial transactions, and autonomous commerce) rather than generic browser automation. That meets the criterion for Direct Financial Execution (crypto/wallet signing and transaction capability).