openserv-agent-sdk

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The required runtime workflow routes platform-triggered task input (potentially attacker-controlled free text from a webhook/x402 request) into the agent’s LLM context via run(agent)/generate() when generating responses.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly connects at runtime to the OpenServ platform (e.g., agents-proxy.openserv.ai and api.openserv.ai webhook endpoints) which deliver tasks/prompts to the agent and therefore externally control prompts/behavior (agents-proxy.openserv.ai; https://api.openserv.ai/webhooks/trigger/${result.triggerToken}; https://api.openserv.ai/webhooks/x402/trigger/...).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes blockchain wallet and on-chain transaction functionality: it mentions a WALLET_PRIVATE_KEY auto-populated by provision(), requires funding ETH on Base for ERC-8004 registration, and shows code calling client.erc8004.registerOnChain(...) with a privateKey—i.e. signing/sending on-chain transactions. This is direct crypto/financial execution capability.