metengine

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests arbitrary text by sending/receiving JSON data from MetEngine’s hosted API, which can include freeform fields like question/signal_summary in responses from endpoints such as /api/v1/markets/trending and /api/v1/markets/intelligence, where those strings ultimately originate from Polymarket market metadata and other upstream data sources.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs agents to run curl to download and overwrite the skill file from https://www.metengine.xyz/skill.md at runtime (auto-update), which directly controls agent instructions by replacing the skill content.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly implements a crypto payment flow: "Pay per request with USDC on Solana" and a two-step x402 payment protocol that requires the agent to load a Solana keypair, create a signer, sign payment payloads, and submit PAYMENT-SIGNATURE headers. The docs include code that constructs a signer from a Solana private key and calls createPaymentPayload / encodePaymentSignatureHeader, and instructs storing the wallet path in persistent memory. This is specific blockchain signing/payment functionality (USDC on Solana), which constitutes direct financial execution authority.