coinhero

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime the agent repeatedly ingests outsider-authored free-text from CoinHero API responses (e.g., nextSteps and error messages) during the end-to-end flow’s POST/GET polling endpoints, and the skill explicitly warns not to follow those embedded instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires the agent to sign and broadcast on-chain transactions that move assets: it directs the agent to deposit ERC‑20 tokens (POST /deals/:id/deposit → returns transactions[] including approve + deposit), to broadcast proposeDeal and setDailyLimit transactions, and to withdraw USDC or tokens (POST /deals/:id/withdraw). It requires a manager wallet that "signs on-chain txs", validates transaction fields, and supports an auto-withdraw that sends USDC earnings to managerAddress. These are specific financial execution actions (payments/asset transfers on-chain), not generic tooling.