agents-pay

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Several input URLs are high-risk: they include an instance metadata endpoint (169.254.169.254) used in SSRF/credential-exfiltration attacks, a URL containing embedded credentials, and explicit attacker/evil test domains that are likely malicious or used to represent malicious endpoints.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path reads attacker-controlled publisher HTTP response text via get_paid_content → paidFetch(url) (calls probeUrl(url)/hardenedGet and parses payment-required header and/or JSON from the response body in x402.ts), so outsider-authored content can reach the skill at request time.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides payment callables and a CLI that execute payments: x402_fetch(url) and prepare_browser_payment(...) are model-visible tools that "pay" for 402-protected content, payment_session_status() checks session spendability, and the architecture references authorize_payment()/settle and the ProcessPayment API. The tool inventory and invocation examples show a sanctioned runtime path that performs actual settlements (including mentions of provider connectors, wallet/instrument creation, and session budgeting). This is a purpose-built payments toolset (not a generic HTTP or browser tool), so it grants direct financial execution capability.