aomi-transact

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly invokes many third-party apps and data sources (see SKILL.md and references/apps.md — e.g., X/Twitter, DefiLlama, 1inch, Khalani, Neynar, Dune) to fetch quotes, routes, social/search results and other public/user-generated content which the agent reads and uses to build and choose transactions, so untrusted external content can materially influence tool actions and signing decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly invokes the CLI at runtime via "npx @aomi-labs/client@0.1.30" (and points to the npm package https://www.npmjs.com/package/@aomi-labs/client), which fetches and executes remote code from npm that the skill requires to operate.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to construct, sign, and submit blockchain transactions. It converts natural-language instructions ("swap 1 ETH for USDC", "open a 3x GMX long", "bet $100 on Polymarket") into calldata, stages transactions, supports wallet signing (EOA/AA, EIP-712), and exposes explicit commands and primitives for signing and broadcasting (e.g., aomi tx sign, commit_tx, commit_eip712, stage_tx, encode_and_call, simulate_batch). It targets EVM chains and integrated DeFi protocols (Uniswap, Aave, GMX, Polymarket, etc.) and includes account-abstraction signing flows and RPC submission. These are specific crypto/blockchain execution capabilities (wallet signing and on-chain submission), so it grants direct financial execution authority.