ctgov-eligibility-screen

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md specifies an endpoint that reads only the caller-supplied query fields (e.g., condition, ageYears, sex, etc.) and returns results from ClinicalTrials.gov, so outsider-authored free text can be ingested at runtime via the skill’s request parameters.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs fetching and running remote code via "curl -sO https://fittings.sh/skill/call.mjs", meaning an external JavaScript file would be downloaded and executed as part of setup/runtime (https://fittings.sh/skill/call.mjs).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes an on-chain/crypto payment flow: it returns a 402 with a signed quote, requires the client to sign an authorization, and gives concrete instructions to set FITTINGS_PRIVATE_KEY and run node call.mjs to pay with USDC on Base. It even references @x402/evm and signing behavior. This is a specific wallet/crypto signing capability (private key usage and spending), which constitutes direct financial execution authority.