mpp-client-fetch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow explicitly instructs runtime web fetching of public pages (e.g., https://www.npmjs.com/package/mppx, https://mpp.dev/overview, and web-search results), and any readable text from those outsider-authored sources could be ingested into the agent/LLM context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides a client that performs automated on-chain and gateway payments: it automatically detects HTTP 402 payment challenges and "automatically pays using the configured wallet/payment method." Configuration examples include a crypto wallet privateKey (Tempo) and Stripe SPT tokens, and multi-method setups with tempo (wallet) and stripe (spt). The doc also describes receipt capture, spending controls, budget caps, and CLI tooling to execute payments. These are specific financial execution capabilities (wallet signing and gateway payment tokens), not generic tooling.