diagnose-github-actions

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime the required workflow fetches outsider-authored content—bounded exact-attempt job logs from a public GitHub Actions run via the GET <production_api>/api/run?run_url=<URL_ENCODED_PUBLIC_RUN_URL> call—which then become LLM-readable log excerpts in the agent context (explicitly treated as untrusted evidence, i.e., free text from others).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to fetch and read https://cristianmoroaica.github.io/bountyverdict/agent-manifest.json, which provides configuration (production_api, status) that directly controls the agent's decision flow, so it is a required external runtime dependency that can influence prompts/behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes payment-related operations: it instructs making a GET payment-challenge request, requires an HTTP 402 x402 v2 payment scheme, and binds payment parameters to a specific blockchain network (Base mainnet eip155:8453) and a canonical USDC contract address with an atomic-unit cap. It also references wallet activity and secrets handling. These are explicit crypto payment/payment-execution details (network, asset, recipient, amount cap, and wallet reconciliation), so the skill grants direct financial execution authority.