schema-infer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow reads only service catalog metadata and then sends user-supplied records JSON directly as the request body to https://fittings.sh/v1/schema/infer, but it does not ingest any outsider-authored free text from an externally writable feed/inbox/search result without the agent selecting a specific service endpoint.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill describes a concrete payment flow: the endpoint returns a 402 with a signed quote, the client must "sign the authorization" and retry with a PAYMENT-SIGNATURE header, and a facilitator broadcasts/pays gas. It explicitly refers to using a wallet (USDC on Base), storing a private key (FITTINGS_PRIVATE_KEY), and provides crypto tooling (@x402/core, @x402/evm). These are specific crypto/payment integrations that enable signing and authorizing on-chain/off-chain payments — i.e., direct financial execution capability.