ckb-ccc-playground

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow includes loading executable code from an arbitrary public raw URL via the Playground ?src= query parameter, so outsider-authored free text/code can be fetched at runtime and ingested into the LLM context through the Playground’s code execution/rendering path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The playground explicitly supports loading and executing arbitrary remote scripts via the ?src parameter (https://live.ckbccc.com/?src=), so external raw URLs fetched at runtime will be executed in the environment.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides a pre-connected blockchain signer and high-level transaction helpers (imports of signer/client, example code that builds a transaction, calls tx.completeInputsByCapacity(signer) and tx.completeFeeBy(signer), and uses ccc.spore.createSpore({ signer, ... })). It also warns that mainnet transactions are real. These are specific crypto/blockchain signing and transaction-execution capabilities (direct financial execution).