jupiter

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime fetch flow in templates/jupiter-client.ts ingests first-party Jupiter JSON (swap quote/swap/price) returned over HTTP (e.g., res.text()/res.json()) but there is no queue/feed/email/chat/community ingestion path for outsider-authored free text to be consumed without the user/provider explicitly making specific API calls with their supplied parameters.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's "Fresh Context Policy" (SKILL.md) requires the agent to fetch remote docs/OpenAPI specs at runtime and treat them as the source of truth (e.g., https://dev.jup.ag/openapi-spec/ultra/ultra.yaml), so these external URLs will directly influence agent instructions and behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to perform crypto financial operations: it documents swap/order endpoints (e.g., /ultra/v1/order, /ultra/v1/execute), lending deposit/withdraw endpoints, limit/recurring order create+execute flows,/send endpoints for crafting token transfers, and includes a signAndSend implementation to sign and broadcast transactions. These are direct blockchain/crypto transaction execution capabilities (wallet signing, swaps, deposits/withdrawals, order execution), which meet the "Direct Financial Execution" criteria.