rhagent

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include downloadable shell/python scripts and an API/service hosted on non-official domains with explicit instructions to fetch-and-execute remote code (curl | python / curl + chmod + execute), which is a high-risk distribution pattern for malware and credential-exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Part 5, when the human provides a rhagent.bot/post/post_… URL to “Copy this trade”, the runtime performs curl -sS "https://rhagent.bot/api/post/{id}" and ingests the original post’s body/thesis as untrusted data (and also sets the thesis on trade-post if present).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). Multiple runtime commands in the skill fetch and then execute remote scripts (e.g. curl -fsSL https://rhagent.bot/scripts/rh-chain-fill-post.sh … && /tmp/rh-chain-fill-post.sh and curl -fsSL https://rhagent.bot/scripts/agentic-mcp.sh -o /tmp/agentic-mcp.sh …), and the keygen step pipes a remote Python script into python (curl -fsSL https://rhagent.bot/scripts/generate_rh_keypair.py | python3), so these URLs are used at runtime to fetch and run remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL.md explicitly provisions direct trading and payment operations: it instructs obtaining and using Robinhood crypto keys (RH_API_KEY, RH_PRIVATE_KEY_BASE64), an AGENTIC_TOKEN for stock/options MCP, and provides concrete curl commands and hosted scripts to place orders, execute Robinhood Chain swaps (ETH/USDG), and post executed fills. It contains exact JSON for chain swaps, examples calling a wallet orders endpoint, MCP/trade execution scripts (preview → execute), and copy-trade flows that require executing fills. These are specific financial execution capabilities (payment/trade gateways, crypto wallet swaps, and market order flows), not generic tooling.