identifier-check

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/call.mjs, the --search free-text query and --describe/service call arguments provided by the user are sent as HTTP request parameters/body to https://fittings.sh/catalog/... and then the gateway response text is ingested and JSON-parsed at runtime (e.g., lines 67-84, 70-76, 101-117, 194-200, 234-246), so outsider-authored text can reach the runtime without any trusted-item selection step.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The runtime script (scripts/call.mjs) defaults to and fetches from https://fittings.sh to read service catalog/schemas and payment terms, and those fetched JSON documents directly control request construction and the payment/authorization flow, so the external host is a runtime dependency that controls the agent's behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes paying via USDC on Base and requires a wallet private key (FITTINGS_PRIVATE_KEY) to be set so the gateway can sign/submit transfers. It states payments are off-chain signatures authorizing USDC transfers and that the facilitator submits the transaction (covering gas). This is a specific crypto payment execution capability (sending USDC), not a generic API or browser action.