azzle

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required workflow reads untrusted marketplace/subgraph JSON from the AZZLE subgraph endpoint to discover open tasks (POSTed listings) without requiring prior selection of a specific item first, creating an indirect prompt-injection surface via attacker-authored listing/proof-related fields.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly enables on-chain financial actions: it requires a Bankr skill "for wallet, swaps, approvals, and transactions" (SKILL.md:8), documents contract addresses and escrow/vault mechanics, lists explicit on-chain functions (e.g., AgentDepositVault.topUp, postTask, fundTask, acceptMilestone) and example prompts to "swap", "approve", "top up", "post a task ... with $100 USDC escrow", and Bankr natural-language transaction prompts. These are concrete crypto transaction capabilities (swaps, token approvals, vault top-ups, escrow funding/release) — i.e., direct financial execution.