wormhole

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow “fetching a VAA”, the agent code fetches guardian-signed VAA data from Wormholescan via fetch(url) and parses the response body into bytes (atob(json.data.vaa)), which is outsider-influencable free text/strings at runtime when the attacker can influence what VAA value the API returns for a given chain/emitter/sequence.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes blockchain wallet setup with a private key and code to sign/send on-chain transactions (createWalletClient, privateKeyToAccount, sourceWallet.writeContract). It provides concrete contract ABIs and call examples that move value: publishMessage (payable), NttManager.transfer (NTT token transfer), Token Bridge transferTokens/completeTransfer, and relayer sendPayloadToEvm/quoteEVMDeliveryPrice. These are specific crypto transaction APIs that can transfer tokens/funds — i.e., direct financial execution capability.