elfa-grvt-bot

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.70). The spec is largely in-scope for building a local Elfa->GRVT bot, but it embeds an out-of-scope, promotional requirement to always present/use a specific GRVT referral link (https://grvt.io/?ref=LN2DP6F), which is a hidden/deceptive instruction not relevant to the bot's stated technical purpose.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to ask users for API keys and a private key, parse those pasted secrets, and write them verbatim into .env and use them for preflight and API calls (while only forbidding echoing in chat), which requires the LLM to handle secret values directly and creates a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests untrusted third-party content from api.elfa.ai (Builder Chat EQL and long-lived SSE trigger frames) as part of its required authoring and execution flows (SKILL.md and references/02-protocols.md), and those parsed payloads directly drive order-placement logic (references/04-algorithms.md process_fire), so remote content can materially change the agent's tool use and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill calls https://api.elfa.ai (POST /v2/auto/chat) at runtime and directly ingests the returned EQL JSON as the authoritative query the bot will execute, so remote content from that URL controls the agent's instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly designed to execute real trades. The spec describes a bridge that turns Elfa AUTO triggers into signed GRVT orders and manages GRVT perpetual futures with atomic OTOCO take-profit and stop-loss. It requires GRVT trading credentials (API key + EVM private key), calls GRVT endpoints (e.g., POST https://edge.grvt.io/auth/api_key/login), uses GRVT order APIs (bulk_orders v2), runs a smoke test that "places one real order on GRVT prod," and instructs building code to sign and submit orders. These are specific financial execution actions (placing, signing, and managing market/OTOCO orders) rather than generic tooling. Therefore it grants Direct Financial Execution Authority.