blockrun-mcp-live-data

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can be ingested via blockrun_exa when the runtime calls action:"contents" with user-supplied urls and text:true, returning scraped page text that the agent then includes in its LLM prompt for summarization.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime execution of remote npm code via npx @blockrun/mcp (https://www.npmjs.com/package/@blockrun/mcp) and also demonstrates fetching arbitrary webpage content at runtime with blockrun_exa (e.g., https://arxiv.org/abs/2401.12345 or https://example.com/article) whose text is injected into LLM prompts, so external content can both execute code and directly control agent prompts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provisions and manages a crypto payment wallet (auto-creates a USDC wallet, shows funding address, “setup” QR), supports on-chain RPC, and exposes a blockrun_wallet API that can delegate per-agent spending limits (agent_limit) and query balance. The platform is payment-on-call (USDC micropayments) and has endpoints that trigger billable purchases (e.g., buy phone number, async paid video/music jobs). Those are specific financial APIs (crypto wallet + budget/delegate actions and payment-triggering endpoints), not generic tooling — therefore it grants direct financial execution capability.