openserv-launch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime path uses the API response body from GET /api/tokens or GET /api/tokens/:address (token name, description, website, twitter, etc.) and injects it into the agent’s natural-language return strings, and that content is outsider-authored because it comes from third-party token creators rather than the operating user.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to perform on-chain financial operations: it exposes an API to deploy ERC-20 tokens, create Aerodrome concentrated-liquidity pools, lock LP positions, and perform an initial buy. The launch endpoint returns transaction hashes (including tokenDeploy, lpMint, lock, buy), and the example agent capability directly POSTs to /api/launch to trigger those transactions. This is direct crypto/blockchain transaction execution (financial execution authority).