forecast-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflows (discover-and-buy, create-precog-market) instruct the agent to submit arbitrary free-form market search queries (e.g., forecast market search "QUERY" ...) and to read provider-derived market data/outcomes at runtime, meaning outsider-authored text can be ingested indirectly via provider search results or user-provided query strings.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly an operator for a trading CLI (Forecast) targeting prediction markets (Polymarket, Precog, Kalshi) and defines workflows/commands to quote, buy, sell, and claim positions. It instructs when to add --confirm and warns that "prediction sell" and "prediction claim" have no dry-run, indicating the agent can submit real transactions. These are specific financial execution capabilities (placing trades/claims), so it grants direct financial execution authority.