finance-district

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to ask the user to share an 8-digit email OTP and then run commands like fdx verify --code <OTP>, which requires embedding the secret OTP verbatim into the agent's output/commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's x402 payment workflow instructs the agent to call arbitrary resource servers (see "x402 Payments" in SKILL.md and references/x402-payment-flow.md) and to read and act on the returned HTTP 402 JSON (accepts[] payment options), meaning untrusted third-party responses can directly influence which payment authorizations the agent signs and sends.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The x402 workflow explicitly instructs the agent to call arbitrary resource-server URLs at runtime (the resource server endpoint used in the x402 flow, e.g. https://api.example.com/protected-resource) and the returned HTTP 402 PaymentRequired JSON directly determines which payment authorization the agent must sign, so that external URL content controls agent actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly and primarily designed to perform financial operations. It exposes a CLI for crypto wallet management (create/setup wallets; send/receive/transfer tokens; swap/trade/exchange; stake, deposit/withdraw from DeFi vaults; bridge tokens; check balances/portfolio; pay for services via x402) and a payment gateway (Prism) to manage merchant accounts, Points of Service, API keys, settlement wallets, payment history, and earnings. It includes commands that authorize and execute payments (e.g., authorizePayment, swaps with --mode Execute, transfer execution) and merchant payment management. These are concrete, purpose-built financial actions (crypto transactions and payment gateway operations), not generic tooling, so they provide direct financial execution authority.