nano

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly directs the agent to fetch and act on data from public RPC nodes (e.g., the "Public zero-config RPC nodes" like https://rainstorm.city/api and https://nanoslo.0x.no/proxy) and mandates reading balances/frontiers and immediately calling wallet.receive/wallet.send based on those RPC responses, so untrusted third-party content can materially influence agent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly requires fetching and executing the remote npm package "xno-skills" at runtime (e.g., via "bunx -y xno-skills@3.1.2", "pnpm dlx xno-skills@3.1.2", or "npx -y xno-skills@3.1.2"), which downloads and runs external code as a required fallback dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a Nano (XNO) wallet operator with built-in tools to move cryptocurrency: it defines and mandates using MCP/CLI commands like wallet.send, wallet.receive, payment.create, payment.receive, payment.refund, wallet.list, wallet.balance, and wallet.change_rep. It covers creating wallets, sending and receiving funds, generating payment requests and refunds, signing transactions, and managing spending limits (maxSendXno). These are specific crypto/blockchain financial execution capabilities (not generic tooling) that allow the agent to initiate and execute transfers of value.