find-next-crypto-idea

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill deliberately collects telemetry (local logging + a conditional curl POST to a configurable external URL) and the network POST occurs in the preamble before the documented opt-in prompt, representing intentional data-exfiltration behavior / a privacy risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime ingests outsider-authored free text via fresh research in scripts/live_research.py, which is invoked by the workflow step “Run fresh research… generate browser-first X queries… and a normalized research pack,” where competitor/OSS evidence is fetched from public X/GitHub/web sources (whose contents can be attacker-controlled).