health-reference

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). In scripts/call.mjs the outsider’s free text is only used as an explicit query argument to the service’s own endpoints via user-provided --search, and the LLM ingests only the resulting catalog/service JSON rather than any automatically monitored outsider text stream (no queue/feed/inbox/callback ingestion path is described).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires and documents on-chain payment via a user-provided private key: it requires "USDC on Base" and instructs setting FITTINGS_PRIVATE_KEY as an environment variable, and describes paying as an off-chain signature authorizing a USDC transfer (the facilitator submits the transaction). These are crypto wallet/payment instructions that enable the agent to sign/authorize transfers — i.e. direct financial execution capability.