solana-payments-wallets-trading

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests open/public third-party content (e.g., sol fetch for arbitrary URLs/x402, token browse and token sync from Jupiter, price data from Jupiter/CoinGecko, and prediction markets via Polymarket/Kalshi) and the CLI uses those external responses to choose routes/prices and drive actions (auto-pick best swap/lending/vaults, execute buys/sells), so untrusted third‑party content can materially influence tool decisions and execution (see SKILL.md and references/fetch-commands.md, trading-commands.md, prediction-commands.md).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Flagging the npx package invocation "npx @solana-compass/cli@latest" because npx fetches and executes remote code from the npm registry at runtime (e.g. https://registry.npmjs.org/@solana-compass/cli) and the skill instructs users to run it as the primary way to use the CLI, making it a required runtime dependency that executes remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a Solana payments/wallets/trading CLI whose primary functions are to move and manage cryptocurrency and execute market operations. It provides concrete commands to send tokens (e.g., sol token send), swap/buy/sell tokens (sol token swap), create/manage wallets, stake/unstake SOL (sol stake new, sol stake withdraw), lend/borrow/deposit/withdraw across protocols (sol lend deposit, sol lend borrow), create recurring DCA buys and limit orders (sol token dca new, sol token limit new), provide liquidity and farm (sol lp deposit, sol lp withdraw), trade prediction markets (sol predict buy/sell/claim), and pay for HTTP resources via x402 which signs USDC transfers (sol fetch auto-pays 402 responses). These are specific, named financial operations (payment transfers, swaps, orders, lending/borrowing, staking/yield) — not generic tooling — and thus constitute direct financial execution authority despite configurable permissions and limits.