fetcher

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). This skill asks the agent to receive and use one-time Bearer API keys from users (and shows examples embedding them in Authorization headers and MCP configs), and even warns that returned keys "land in your context" — meaning the LLM will handle secrets verbatim and may be required to include them in requests or configs, creating exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). fetcher.sh’s MCP workflow exposes an agent to outsider-authored free text because the required tool fetch_data (and the service-specific “search” shortcuts) returns real platform content fields (e.g., tweet text, TikTok captions, Reddit comments) which are then ingested into the agent context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs MCP-capable clients to point at the remote MCP server which at runtime exposes a catalog and tools that directly control the agent's prompts and toolset (e.g., https://fetcher.sh/mcp and https://twitter.fetcher.sh/mcp).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes and provides code for on-chain payments in USDC (via x402) and a prepaid "top up" flow, including signing transactions with a private key (privateKeyToAccount, ExactEvmScheme), a pay-per-call flow requiring signing a USDC transfer authorization, and an MCP paid tool "topup_credits". These are concrete APIs and flows to move funds on-chain (create/sign/submit payments), so it grants Direct Financial Execution authority.