crypto-advisor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md the orchestrator spawns Phase 1 research (including analyse-onchain, analyse-defi, analyse-macro, analyse-smartmoney) that “fetch their own data sources via web_fetch”, and the Narrative/Verdict Critic also “web-fetch ≥3 sources” / “fetch … read-news … and then web_fetch defillama/protocol”, so outsider-authored free text from those URLs is ingested at runtime as part of the briefs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly calls web_fetch on live external URLs at runtime (e.g., https://defillama.com/protocol/{slug}) and injects the fetched article/metric text into subagent briefs, critics, and the final verdicts — meaning remote content is fetched during execution and directly shapes agent prompts/outputs.