dolomite-plugin

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow fetches outsider-authored free text from public web sources (e.g., curl/curl -sf to raw.githubusercontent.com in the version check block, and curl to GitHub release assets like install.sh/checksums.txt), and that fetched text is then used to drive agent behavior/output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's pre-flight install step downloads and then executes remote installer scripts (e.g. "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh") and also fetches launcher/update scripts from raw.githubusercontent.com and binaries from github.com releases at runtime, which are remote code fetches that are executed or installed and are required for the skill to run.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a DeFi trading/interaction plugin for Dolomite on Arbitrum and provides concrete commands that sign and broadcast blockchain transactions: supply, withdraw, borrow, repay (including repay-all), plus token approvals and contract calls via onchainos wallet contract-call. It builds calldata, requires approval flags, submits on-chain txs, and can move funds / create or settle debt. Although it enforces a live-mode confirmation flow, the primary and explicit purpose is executing on-chain financial operations (wallet signing and transaction submission), which constitutes direct financial execution authority.