compound-v3-plugin

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill fetches and uses data from open public sources (on-chain RPC endpoints like https://ethereum.publicnode.com listed in plugin.yaml and remote files/raw scripts from raw.githubusercontent.com in SKILL.md pre-flight), and SKILL.md explicitly instructs the agent to read the returned status/suggestion and run the emitted next_command as part of its workflow, so untrusted third‑party on‑chain/API content can directly influence the agent's decisions and tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The pre-flight install step fetches and executes remote installer code at runtime — e.g. the script downloaded from https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh is saved and run (after checksum), which constitutes executing remote code that the skill depends on.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to perform on-chain financial operations for Compound V3: it provides commands to supply, borrow, repay, withdraw, and claim rewards, and details the exact transaction flow (ERC-20 approve, Comet.supply, Comet.withdraw, CometRewards.claimTo). It integrates with a wallet CLI (onchainos) to sign and submit transactions via onchainos wallet contract-call and returns txHashes and updated balances. These are specific crypto/blockchain financial execution capabilities (sending transactions, moving assets), not generic tooling — therefore it grants direct financial execution authority.