opensea

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). At runtime, the marketplace “buy/fulfill listing” workflow calls OpenSea’s /api/v2/listings/fulfillment_data (via opensea-marketplace/scripts/opensea-fulfill-listing.sh → opensea-post.sh), and the returned JSON (including order/metadata fields) is ingested as readable text into the agent’s context, making it outsider-authored API content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The opensea-tool-sdk register flow explicitly fetches the tool manifest from a metadata URL at runtime (example shown: https://my-tool.example.com/.well-known/ai-tool/my-tool.json), and that fetched manifest is used to register tools (i.e., it can direct the agent to call arbitrary external endpoints / change tool behavior), so a runtime external URL can control agent behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The router SKILL explicitly references sub-skills that perform on-chain financial operations: "Buy/sell NFTs on Seaport, sweeps, cross-chain" (marketplace listing/fulfillment), "Swap ERC20 tokens via DEX aggregator" (token swaps), and "Configure wallet signing (Privy/Turnkey/Fireblocks/Bankr)" (wallet signing/integration). These are specific crypto/financial execution capabilities (market orders/swaps and signing transactions), so the skill surface grants direct financial execution authority via its sub-skills even if the router itself has no operational detail.