contract-decode

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's Step 3 "External API Query" (references/apis.md) explicitly fetches ABIs and signature data from public services (Sourcify, Etherscan, 4byte.directory), which are user-submitted/untrusted content that the agent parses and uses to drive decoding and follow-up actions, enabling indirect prompt injection.