xiond-wasm

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's scripts (e.g., upload-contract.sh, instantiate-contract.sh, query-contract.sh, execute-contract.sh) call public RPC node URLs (https://rpc.xion-testnet-2.burnt.com:443 and https://rpc.xion-mainnet-1.burnt.com) via xiond and parse on-chain transaction and contract-state JSON (user-generated on-chain data) as part of the required workflow, which can directly determine code IDs, contract addresses, and subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The optimize-contract.sh script invokes docker run ... cosmwasm/optimizer:0.16.1, which at runtime will pull and execute remote code from the Docker registry (e.g., docker.io/cosmwasm/optimizer:0.16.1), so the skill depends on and runs external code fetched at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed for interacting with a blockchain (Xion) and CosmWasm smart contracts. It includes concrete commands that perform on-chain transactions using wallets (upload-contract.sh, instantiate-contract.sh, execute-contract.sh, migrate-contract.sh) and returns txhashes. It also mentions integration with a Treasury to fund operations and configuring authz grants. These are specific crypto/blockchain transaction capabilities (wallet use, signing/sending transactions, funding gas), not generic tooling — therefore it grants direct financial execution authority.