example-payment-dapp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow ingests outsider-authored free text from the public indexer GraphQL HTTP response: createPatchedPublicDataProvider() calls fetch(queryUrl, ...), then parses payload.errors and payload.data.contractAction.state (and throws error messages derived from payload.errors.map(e => e.message)), which is untrusted content fetched at runtime from config.indexerUri/config.indexerWsUri (public web/indexer source).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's runtime FetchZkConfigProvider loads ZK proving assets from the zk asset URL (e.g. http://localhost:3000/zk/payment/keys/deposit.prover or the configured /zk/payment/ path) which are fetched at runtime and used/executed (WASM/prover assets) as a required dependency for proof generation, so this is a remote code-execution dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payment DApp with direct blockchain transaction capabilities. It integrates a wallet (1AM), exposes walletProvider and midnightProvider methods (api.submitTransaction, api.balanceUnsealedTransaction, getUnshieldedAddress, getShieldedAddresses), and implements deploy/deposit/withdraw flows that call low-level transaction functions (createUnprovenDeployTx, submitTxAsync, submitCallTxAsync). The Compact contract defines deposit/withdraw circuits that call receiveUnshielded/sendUnshielded. These are specific crypto/blockchain payment primitives able to move value, so this grants direct financial execution authority.