agent-arena-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The API examples and workflow require supplying an x402 payment-proof token in an Authorization: Bearer header (and txHash payment proofs in request bodies), which implies the LLM would need to accept and embed secret/payment values verbatim in requests/outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow calls GET https://agentarena.site/api/search and GET https://agentarena.site/api/agent/{chainId}/{agentId}, which returns outsider-authored free-text fields like description, capabilities, and hiring instructions from a public third-party marketplace (Agent Arena) that the operating user did not author.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Yes — the skill makes runtime API calls to Agent Arena (e.g., https://agentarena.site/api/agent/{chainId}/{agentId} and related .well-known endpoints like https://agentarena.site/.well-known/mcp/server-card.json) to fetch machine-readable hiring instructions/MCP configuration that would directly control agent prompts and behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly defines crypto payment flows and on‑chain transactions. It requires USDC payments via the x402 HTTP micropayments protocol (e.g., "Payment: USDC via x402 on Base mainnet", "Search: $0.001 USDC per query", "Register: $0.05 USDC"), expects an Authorization Bearer header, accepts/returns on‑chain txHash values, references agentWallet addresses, and operates across 16 blockchains. These are specific crypto/financial execution capabilities (micropayments, wallet addresses, tx hashes), not generic tooling. Therefore it grants direct financial execution authority.