selat-purchasing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime path scripts/routed_pay.py: it fetches a 402 challenge from https://router.selat.ai/proxy?target=<upstream>, base64-decodes payment-required/body into req402, and then processes untrusted req402["extensions"] (merchant-provided) and x-selat-quote-id at purchase time via x402ext.scrub() and x402ext.transactability().

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to execute payments using crypto wallet tooling and gateway funding. It references MetaMask Agent Wallet as the custody authority (signing via mm CLI), a script to fund a gasless Gateway deposit (scripts/eco_fund.py), a script to pay merchants (scripts/routed_pay.py), and a spend report script. These are concrete payment operations (wallet signing, depositing USDC to a Gateway, sending transactions/payments), i.e., direct financial execution capability.