opensea

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and interprets user-generated marketplace data from OpenSea's public REST API/CLI (https://api.opensea.io/api/v2) as shown in SKILL.md (listings, offers, events, search) and uses those responses (e.g., order_hash, fulfillment payloads) to drive trade decisions and actions, exposing the agent to untrusted third-party content that could contain malicious instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes remote code at runtime via "npx @opensea/cli@latest", which fetches and executes the @opensea/cli package from the npm registry (e.g., https://registry.npmjs.org/@opensea/cli) and is a required runtime dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports executing on-chain NFT marketplace trades (Seaport) and related write flows. It provides CLI tooling and scripts for fulfillment (opensea-fulfill-listing.sh, opensea-fulfill-offer.sh), creating listings/offers (opensea-post.sh), building mint transactions (drops mint / build mint tx), and notes flows for signing and submitting transaction calldata. It also documents optional Privy credentials for signing/fulfillment and describes submitting signed txs. These are specific crypto/blockchain financial operations (constructing, signing, and fulfilling market orders on-chain), not generic tooling, so it grants direct financial execution capability.