kleros-curate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow fetches and parses MetaEvidence/policy JSON from IPFS via gateway URLs derived from onchain events (e.g., fileURI/_evidence → fetched JSON text), which is outsider-authored content and is then included in the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches MetaEvidence and policy JSON from IPFS (https://cdn.kleros.link/ipfs/, https://ipfs.io/ipfs/) and uses hardcoded Goldsky GraphQL endpoints (https://api.goldsky.com/.../pgtcr-*-gn/...) plus the Kleros upload gateway (https://kleros-ipfs-gateway.fly.dev/upload-to-ipfs) at runtime to obtain the authoritative schema/policy and artifacts that directly control agent behavior and submission logic, and those external endpoints are required for correct operation.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes on‑chain financial operations: computing exact deposit amounts (msg.value), ERC20 approval and stake deposit flows, sending transactions such as addItem, challenge/removeItem, funding appeals, and references arbitration costs and capturing deposits as bounties. These are specific blockchain payment/transaction actions (including token approvals and moving deposits), i.e. direct financial execution capabilities.