route-github-agent-checks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow reads and follows an outsider-authored remote skill document—https://cristianmoroaica.github.io/bountyverdict/skills/<OPERATING-SKILL>/SKILL.md—at runtime (and also reads an outsider-authored manifest and openapi), so its free-form text is ingested into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly directs the agent at runtime to fetch and follow the manifest at https://cristianmoroaica.github.io/bountyverdict/agent-manifest.json (and then the referenced skill URL https://cristianmoroaica.github.io/bountyverdict/skills//SKILL.md and production API origin https://bountyverdict-agent-production.mimirslab.workers.dev), so remote content will directly control agent instructions and required behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires making on-chain payments: it lists atomic USDC caps for each product, demands an HTTP 402 x402 payment challenge, specifies Base mainnet (eip155:8453), the canonical USDC contract address, and a recipient address, and instructs the agent to "Bind the payment client" and reconcile wallet/settlement state. These are specific crypto payment instructions (signing/sending transactions), so this is direct financial execution capability.