cattown

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Runtime LLM context can include outsider-authored free text from public API JSON fields like fishName, basename, equipment strings, and name/rarity/traitValues returned by GET https://api.cat.town/v1/tickets/leaderboard, GET /v2/items/master, and GET /v2/items/capsule/<address> (these are not authored by the operating user and are ingested as readable strings).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes and documents onchain write methods that move value: staking/unstaking KIBBLE (kibble.approve, revenueShare.stake, unstake, unlock/relock), claiming rewards (revenueShare.claim / claimAndRestake), purchasing Gacha pulls (purchaseAndOpenCapsule — payable, consumes KIBBLE + msg.value for VRF), selling NFTs to the vendor (SellItems.sellMultipleNFTsToContract) and claiming raffle tickets (claimFreeTicket). It also includes concrete execution examples (bankr agent prompt, bankr wallet submit) and preflight/approval flows. These are specific crypto financial operations (token transfers, payable calls, swaps/suggested KIBBLE→ETH swaps, approvals) — not generic tooling — so this skill grants direct financial execution authority.