openmarket

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes command-line examples and setup flows that accept API tokens, webhook URLs, and bearer tokens as explicit flags or prompts (e.g., --token, --webhook-url, --bearer-token), which would require an LLM to emit those secret values verbatim in generated commands or interactions.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Required runtime workflow for creating/managing event-watch content (“om news …”/“om event-watch …” reads and builds event journals from upstream Synoptic/openmarket feeds), so outsider-authored free text from those feeds can be ingested at runtime by the daemon without selecting a specific trusted item first.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes order-placement and automated trading on execution venues (Polymarket CLOB and Hyperliquid): it documents "one-shot order placement" via om order place, daemon-native strategies that execute in live/paper/dry_run modes, auto-execution hooks (on_fire.execute), and venue pairing with signer/funder/wallet details. These are specific crypto/market-order capabilities (wallets/signing and trade execution), so it grants Direct Financial Execution Authority.