brian-api

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the LangChain/OpenAI agent passes outsider-provided free text (the user’s input/prompt) directly into Brian’s POST https://api.brianknows.org/api/v0/agent/transaction and POST https://api.brianknows.org/api/v0/agent/knowledge, where it is ingested as the LLM instruction.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill makes runtime calls to Brian's API which returns executable transaction calldata that the agent/client signs and broadcasts (e.g., https://api.brianknows.org/api/v0/agent/transaction and https://api.brianknows.org/api/v0/agent/knowledge / https://api.brianknows.org/api/v0/agent/smart-contracts — the API responses directly drive on-chain execution), so these external endpoints are runtime dependencies that control executable behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL.md describes a Web3 transaction API that explicitly converts natural-language intents into executable transaction calldata for swaps, bridges, transfers, deposits, withdrawals, borrows, and repays across multiple EVM chains. It documents an endpoint (/agent/transaction) that returns step-by-step transaction calldata, shows the response shape with transaction "steps" (to, data, value, gas), and includes full examples that sign and broadcast those transactions via viem and ethers.js. It also provides LangChain toolkits that accept a private key/account (privateKeyOrAccount) and expose tools for swap/bridge/transfer, plus integration with Coinbase CDP keys. These are specific crypto financial execution capabilities (generating and enabling signing/sending of on-chain transactions), so this skill grants Direct Financial Execution Authority.