get-prediction-markets

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt mandates sending an API key in the X-WorldMonitor-Key header and even includes a literal-looking example key, which encourages embedding secrets verbatim in generated commands or code and thus creates an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow calls a server endpoint (GET https://api.worldmonitor.app/api/prediction/v1/list-prediction-markets) that returns market titles/prices as JSON, which the agent will ingest as readable text; those titles are sourced from external prediction-market providers (e.g., “polymarket”), making the content outsider-authored free text at runtime.