flow-nexus-platform

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's examples and API call templates embed secrets (passwords, API keys, tokens, DB URLs) as literal parameter values, which would require the LLM to include those secret values verbatim in generated calls or code — an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill ingests outsider-authored free text at runtime via the mcp__flow-nexus__seraphina_chat message/conversation_history and via code/file content that the user supplies for sandbox execution/logging.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a startup_script that runs "git clone https://github.com/user/repo" followed by installing packages (cd repo && npm install), which fetches and executes remote code at runtime (https://github.com/user/repo).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes explicit payment APIs: mcp__flow-nexus__create_payment_link (which "Returns secure Stripe payment URL") and mcp__flow-nexus__configure_auto_refill (enable/disable auto-purchase of credits). These are specific payment gateway / purchase operations (creating payment links and configuring automated purchases), so the skill grants direct financial execution capability.