cometbft

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly instructs the agent to query and use data from public CometBFT RPC endpoints and block explorers (e.g., the state-sync and light-client sections showing curl to https://...:26657/commit and recommending “publicly exposed RPC's or a block explorer”), which are untrusted third‑party sources whose responses are read and used to make trust/sync decisions—so external content can materially influence actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly about operating a blockchain consensus engine (CometBFT) and repeatedly references validator signing and private validator keys (e.g., "priv_validator key/state", "Validator / signing problems", "double-sign", and concerns about exposing priv_validator keys). Those are specific crypto/blockchain operational capabilities related to signing and validator control — i.e., core primitives that enable movement/validation of on-chain value. Although it focuses on engine-level consensus rather than application business logic, the presence of explicit signing/validator key management and consensus-driven transaction ordering qualifies it as a crypto/blockchain execution capability.