nla-arbitrate

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The document instructs use of API keys and a private key as CLI flags (and even shows an example with "sk-..."), which requires embedding secret values verbatim in commands and therefore risks secret exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow (“auto mode”) calls nla escrow:arbitrate --escrow-uid <uid> --auto and, per SKILL.md:55-56, uses the LLM specified in the escrow’s demand; this implies the command will ingest the escrow demand’s free-text content into the LLM context, and that demand is outsider-authored (a counterparty’s escrow input), creating an indirect prompt-injection path via on-chain/off-chain escrow data.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides a CLI command (nla escrow:arbitrate) to arbitrate on-chain escrows, requires the user's private key and ETH for gas, and records decisions as on-chain attestations. These are direct crypto/blockchain actions (wallet signing/submitting transactions that affect escrow funds), so it grants direct financial execution capability.