nft-collection-liquidity-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow queries public NFT marketplace data (OpenSea collection metadata, search results, activity feeds, and order books) via the Crawlora API, where any third party can list collections or inject text into descriptions and marketplace events.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill executes runtime API calls to https://api.crawlora.net via scripts/crawlora.sh, an unofficial service with unknown third-party provenance, constituting a high-risk unverifiable runtime external dependency.