fulfill-git-escrow

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt explicitly shows and recommends passing a private key on the command line (--privateKey "0x..."), which requires embedding a secret verbatim in generated commands and is an insecure credential-handling pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md:38-46 instructs cloning the escrow test repository from an escrow-provided URL and reading its test files at runtime, which means the agent will ingest outsider-authored repository contents (free-form code/test text) into the LLM context as it “read[s] the test files to understand what the tests expect.”

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates with a crypto escrow CLI ("git-escrows") and shows commands that use a private key and network (e.g., --privateKey "0x...", --network "sepolia") and specific actions to "fulfill" and "collect" an escrow. These are concrete blockchain/crypto operations that can move funds (submitting fulfillment and collecting escrowed rewards), so it grants direct financial execution capability.