preflight-agent-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md’s required runtime workflow has the agent read external public web content at runtime (Read https://cristianmoroaica.github.io/bountyverdict/agent-manifest.json and then inspects remote <production_api> endpoints), which can contain free-form text that would be injected into the LLM context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly defines and enforces a crypto payment flow: it requires an x402 payment challenge (HTTP 402 / x402 v2), specifies the target network (eip155:8453 / Base mainnet), a canonical USDC recipient address, an atomic-unit amount cap, and instructs retrying with an "x402-compatible client" and reconciling wallet activity. Those elements are specific to executing blockchain payments (wallet interactions/signing/send) rather than generic tooling, so this is direct financial execution capability.