senpi-strategy-ops

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes fetching a remotely authored strategy package from the Senpi-ai/senpi-skills GitHub repo (via scripts/_fetch.py) into the durable strategies root, after which deploy.py/validate.py load and ingest its free-text YAML/scan.py contents at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The deploy path fetches strategy packages at runtime from GitHub (see the explicit https://raw.githubusercontent.com/Senpi-ai/senpi-skills/refs/heads/main/strategies/catalog.json and the fetch calls to api.github.com / raw.githubusercontent.com), writing remote repository files (including scanners/scan.py) to disk which the runtime can execute — so fetched remote content directly controls executed code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly performs wallet creation and funding and exposes commands that move money. Examples: "funds preflight → wallet create+fund" and the deploy command deploy.py create <id> --budget <usd> that validates then starts a funded deploy; the text describes automatic funding (USDC, bridge), hard budget enforcement/refusals, and that closing returns funds. These are specific, money-moving operations (wallet creation, funding, transfers), not generic I/O or read-only actions, so this grants Direct Financial Execution authority.