intelligent-oracle

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—at runtime the workflow fetches public web content during oracle resolution (validators fetch the evidence page(s) from user-provided/derived URLs), and those outsider-authored page texts can be ingested by the LLM-driven validators (indirect prompt-injection path); SKILL.md:339-341.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly instructs the agent to perform on-chain write operations: calling create_new_prediction_market on a factory, using genlayer-js client.writeContract, creating/using an account via a PRIVATE_KEY (createAccount), and sending signed transactions (eth_sendRawTransaction). It also shows invoking resolve() (a write) and polling transaction receipts/triggered child txs. These are crypto/blockchain signing and transaction actions — direct financial execution authority per the crypto/blockchain (wallets/signing) criterion.