erc-8004

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The script scripts/get-agent.sh fetches agent profiles from IPFS or HTTP URLs provided on-chain via agent IDs, allowing external third parties to inject untrusted text content into the agent's runtime context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill involves blockchain and cryptocurrency interactions, specifically bridging ETH, managing private keys for transactions (privateKey: process.env.PRIVATE_KEY), and executing on-chain smart contract transactions (registering NFTs and identities on Ethereum mainnet via agent0-sdk and scripts like bridge-to-mainnet.sh). These operations fall under crypto/blockchain transaction execution, meeting the criteria for Direct Financial Execution.