deepspace

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes a non-interactive CLI login example using --email and --password (i.e., secrets passed as command-line arguments) and describes .dev.vars secret bindings, which can encourage or require embedding plaintext credentials verbatim in generated commands — an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required workflow instructs the agent to call and consume external integration endpoints (via integration.post / npx deepspace invoke and the api-worker proxy) and documents many third-party integrations (search, social, media, LLMs, Google, etc. in references/integrations.md and the assets/integrations catalog); those live, user/upstream-generated responses are read and used by the agent (e.g., integration responses and tool outputs feed the AI-chat/tool pipeline), so untrusted third‑party content can materially influence decisions and tool actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes an explicit payment integration: the CLI exposes "npx deepspace domain buy # buy via Stripe Checkout (browser opens)". That is a specific Payment Gateway integration (Stripe Checkout) for purchasing domains. The docs also call out integrations that include "finance" endpoints and describe billing-related behavior (owner-pays, billing on invoke, domain purchases), which indicates concrete, non-generic financial execution actions. These are specific financial operations (payment gateway use), so it meets the Direct Financial Execution criteria.