hoodmarkets

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime ingests outsider-authored free text via the X/Twitter “full Tweet object” passed into the flow (including user-controlled media/tweet content) before calling POST https://api.hood.markets/api/agent/resolve-deploy-image and POST https://api.hood.markets/api/agent/prepare-deploy, so attacker-submitted tweet text/metadata can reach the agent path without selecting a specific trusted item first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill issues runtime calls to https://api.hood.markets whose JSON responses (e.g., replyHint / confirmReplyHint and prepare-deploy steps[].body / imageUrl) are explicitly trusted and used verbatim to drive agent replies and deploy bodies, so this external host directly controls agent prompts at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill explicitly provides crypto financial execution capabilities: it instructs the agent to deploy tokens, prepare and submit on-chain buy/sell transactions (using chainId 4663), and call endpoints that trigger on-chain actions (POST /api/deploy, POST /api/agent/claim, POST /api/agent/claim-for-recipient). It also shows submitting transactions via Bankr's wallet submit (POST https://api.bankr.bot/wallet/submit). These are specific blockchain transaction and wallet-submit operations (direct financial execution), not generic tooling.