ens

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path in templates/resolver-client.ts resolves ENS by calling publicClient.getEnsAddress/getEnsName/getEnsAvatar/getEnsText using caller-supplied name strings, and ENS text/avatar/content returned from onchain/offchain sources is read by the LLM (not just first-party docs) which can contain outsider-authored free text in records (and CCIP-Read may fetch gateway-provided content).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit blockchain wallet operations: it constructs an account from a private key and a wallet client, then uses walletClient.writeContract to submit payable transactions (commit/register and renew) with a value in ETH. These are specific crypto transaction APIs (signing and sending ETH) and therefore grant direct financial execution capability.