security-screening

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow reads outsider-authored free text via the --search path (query is user-supplied and is sent as q= into /catalog/search and the resulting matching service descriptions are printed), so an outsider can post arbitrary text that the workflow consumes without first selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime code fetches service metadata and payment terms from https://fittings.sh (e.g. the catalog and skill SHA at runtime via BASE='https://fittings.sh'), and those JSON responses directly control which endpoints, request schemas and payment flows the script will perform.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill explicitly requires and describes on-chain payment: it asks for a wallet private key set as an environment variable, specifies payment in USDC on Base, and describes an off-chain signature authorizing a USDC transfer that the facilitator will submit (covering gas). Those are direct crypto wallet signing/transfer instructions — i.e., direct financial execution capability.