feast-league

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow uses FL data to read public market snapshots, prices, and the public notes feed from feast.meme (/api/v1/snapshot, /api/league/notes), which contain outsider-submitted notes and market activity from other players.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates a direct financial workflow on BNB Smart Chain via a user's Binance Agentic Wallet, executing token purchases and sales (FL buy, FL sell) and launching memecoins (FL meme). Although transactions are subject to configured hard limits and require an initial user confirmation ("yes"), there is no independent, service- or execution-layer authentication or authorization check enforced on the underlying agentic wallet transaction routes themselves—execution relies on the agent issuing local CLI commands (FL buy, FL sell, FL start) authenticated locally via the wallet's developer mode session. Therefore, this qualifies as a direct financial operation without established qualifying independent access control.