preflight-github-bounties

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow instructs the agent to read a public manifest JSON from https://cristianmoroaica.github.io/.../agent-manifest.json at runtime (SKILL.md:7-9), which is outsider-authored free text/content fetched from the public web and ingested into the LLM/context for decision-making.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to read and act on the manifest at https://cristianmoroaica.github.io/bountyverdict/agent-manifest.json (using its status and production_api to decide whether to continue and which API endpoint to call), so remote content directly controls agent behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly instructs the agent to perform crypto payments: it specifies payment amounts and asset (USDC), a blockchain network (Base mainnet eip155:8453), an on-chain asset address, and directs using an "x402-compatible client" and to "bind the payment client" and retry requests with payment after validating the x402 challenge. These are specific, actionable instructions to execute financial transactions on-chain rather than generic API or browsing guidance.