classify-github-flakes

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). At runtime the required workflow fetches and passes data from a public GitHub Actions run into the agent via the FlakeVerdict API call constructed from run_url (SKILL.md:12-16,36-47); that upstream GitHub-origin evidence is outsider-authored free text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill requires calling the external FlakeVerdict service at https://bountyverdict-agent-production.mimirslab.workers.dev/api/flake?run_url=<URL_ENCODED_CANONICAL_RUN_URL>[&attempt=<POSITIVE_INTEGER>] at runtime and uses its response fields (e.g., decision.retry) to control whether to retry CI, so this external URL directly controls agent behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly specifies cryptocurrency payment details and instructs the agent to authorize/pay: it requires an HTTP 402 x402 v2 payment flow, bound to Base mainnet (eip155:8453), a specific Base USDC asset contract address, an exact recipient address, and a capped amount — and it directs binding the payment client to that origin/network/asset/recipient and reconciling wallet/settlement state. These are concrete crypto/payment execution instructions (sending funds), so this is direct financial execution capability.