sablier-cancel-open-ended-stream

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). High likelihood: the workflow queries a public Sablier Streams indexer (outsider-authored web/API content) via curl and then pipes the returned JSON fields (e.g., alias, asset.symbol, contract, etc.) into the agent’s runtime planning/preview context, which can include free-text strings originating from that outsider source.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly performs on-chain financial actions: it discovers and cancels Sablier Flow payment streams and constructs/broadcasts atomic on-chain transactions (using batch(bytes[]), void(uint256), refund/refundMax) that move ERC‑20 token funds and require the user's wallet to sign approvals. These are specific crypto transaction operations (refunds, voids, batch transactions), so the skill grants direct financial execution capability.