botcoin-miner

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the mining loop, the workflow fetches the coordinator’s /v1/challenge response and then has the LLM read the returned doc and follow solveInstructions/payload-derived instructions before submitting via /v1/submit, so outsider-authored free text is directly ingested at runtime (the challenge payload provenance is not first-party trusted).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill fetches challenge payloads (including authoritative "solveInstructions" and other prompt-controlling fields) from the coordinator at https://coordinator.agentmoney.net (e.g. ${COORDINATOR_URL:-https://coordinator.agentmoney.net}/v1/challenge), so the coordinator URL is a runtime external dependency that directly controls agent prompts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly instructs the agent to perform on-chain financial operations: it requires a Bankr API key with write/agent access, uses Bankr endpoints to sign messages and submit raw transactions, instructs swapping ETH for BOTCOIN and bridging ETH, and details staking/unstake/claim flows that submit pre-encoded calldata on-chain. These are explicit crypto wallet, swap, signing, staking and transaction-submission operations — i.e., direct financial execution.