deepbook-predict

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow ingests only trusted first-party skill/reference content and, at runtime, fetches oracle data from a fixed public endpoint (https://predict-server.testnet.mystenlabs.com) rather than reading outsider-authored free text directly submitted into a queue/feed by an attacker.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains explicit runtime fetch instructions that drive agent outputs, including fetching oracle data from https://predict-server.testnet.mystenlabs.com and guidance to query documentation at https://docs.sui.io/onchain-finance/deepbook/deepbook-predict and the MCP server https://sui.mcp.kapa.ai (and references the deepbookv3 repo https://github.com/MystenLabs/deepbookv3) which the skill instructs the agent to consult before answering, so these external endpoints directly control runtime responses.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed for on-chain financial operations. It documents using the @mysten/deepbook-predict SDK or building transactions with @mysten/sui to create PredictManager accounts, deposit DUSDC, mint binary and range positions, redeem positions, and supply/withdraw PLP (LP) liquidity. Those actions are specific blockchain financial operations that can move or manage funds (DUSDC and PLP) and construct/send transactions, so this grants direct financial execution capability.