finance-district

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to ask the human for an email OTP and to run a CLI command embedding that OTP (fdx verify --code ), which requires the LLM to handle and output a secret value verbatim, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The fd-agentic-commerce skill explicitly fetches and parses arbitrary merchant discovery docs, product feeds, checkout-session responses and x402 accepts[] entries from user-supplied merchant URLs (see skills/fd-agentic-commerce/SKILL.md and references/x402-payment-flow.md), and the agent uses that untrusted third-party content to select payment options and drive subsequent actions (authorize payments and complete checkouts), which creates a clear avenue for indirect prompt injection.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly and primarily designed to perform financial transactions. It exposes the Finance District CLI (fdx) with concrete wallet and payment gateway commands: create/setup wallets, send/receive/transfer tokens, execute swaps (QuoteOnly → --mode Execute), stake/earn/withdraw DeFi funds, bridge tokens, fund wallets, and x402 payment authorization via fdx wallet authorizePayment. It also includes Prism payment-gateway management (create/manage settlement wallets, API keys, Points of Service, list/payments, earnings). These are direct payment, crypto signing, and merchant settlement operations — i.e., tools to move money.