Relay

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime LLM context can be influenced by outsider-authored free text returned by the Relay API (e.g., api.relay.link/quote and api.relay.link/intents/status), which the plugin parses and prints as JSON fields like error, message, and step descriptions—these strings can contain attacker-controlled content that may be ingested by the agent’s LLM when the user/agent relays the output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's auto-injected pre-flight steps download and (after checksum) execute remote installer scripts and binaries at runtime — e.g. it curls and runs "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" and downloads binaries from "https://github.com/okx/plugin-store/releases/download/plugins/relay-plugin@0.1.1" (plus raw.githubusercontent.com scripts for launcher/update-checker), which fetches remote code that is executed/installed and is required for the skill.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to move money: it implements a cross-chain crypto bridge that sends ETH and ERC-20 tokens (USDC, USDT, DAI). It requires an EVM wallet, describes approval and deposit transactions, and provides an explicit execute command (relay-plugin bridge ... --confirm) that broadcasts on-chain transactions. These are direct crypto transaction/payment capabilities, not generic tooling.