warp-deploy-fund-deployer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text is ingested when the skill fetches the Linear issue’s title and description via the Linear GraphQL API (public/third-party authored content) in Step 1, and then displays/uses that text in subsequent parsing.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes commands and procedures to transfer cryptocurrency and tokens from a deployer key to recipient addresses. Step 8 generates exact funding commands (pnpm tsx scripts/funding/fund-wallet-from-deployer-key.ts) and instructs the agent to ask for confirmation and then run those commands, reporting tx hashes and re-checking balances. It also references using the Hyperlane deployer key (HYP_KEY) and performing on-chain token/native transfers. These are specific crypto wallet transfer actions (direct financial execution), not generic tooling or read-only queries.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt instructs the agent to generate and execute funding scripts (pnpm/tsx and cast commands) that use deployer keys from the environment to transfer funds and perform privileged blockchain actions from the host—this requests the agent to run state-changing, sensitive operations (including use of secrets) on the machine/infra.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)