ampersend

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The payment workflow shells out to ampersend fetch --pay <url> with the attacker-provided URL/body, causing the CLI to ingest and return the fetched response body (free text) from an outsider-chosen destination at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payments tool: it describes agent-held and service-held keys that co-sign on-chain payments, funds held in a smart account, use of a payment standard (x402) with USDC, and provides concrete CLI commands to authorize and submit payments (e.g., ampersend fetch --pay). These are specific financial execution capabilities (sending transactions / moving funds), not generic I/O tools.