megapot

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow for “did I win?”/claim uses the outsider-authored Megapot Data API response body (public JSON from https://api.megapot.io/v1/wallets/{address}/wins?...) which is free-form text/fields that the agent ingests into LLM context for confirmation and claim construction.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires fetching live task pages from https://llms.megapot.io/tasks/ (and related pages under https://llms.megapot.io/) at runtime to obtain the up-to-date "code recipe" that directly controls the agent's instructions and behavior, so this is a runtime external dependency that controls prompts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to perform on-chain financial operations: it instructs the agent to execute USDC approvals and purchase transactions (buy-random, buy-tickets, buy-bulk, subscribe, auto-compound), includes contract addresses and ABI locations, and requires the Bankr wallet skill to sign and submit Base transactions. It also covers claiming winnings and LP deposit/withdraw flows. These are concrete crypto/blockchain financial actions (token approvals, transfers, and contract calls) intended to move money/value. Therefore it grants direct financial execution authority.