badwhale-api-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires the agent to include BADWHALE_API_KEY and BADWHALE_BASE_URL inline on command lines and even tells the agent to ask the user for raw API credentials and substitute them verbatim, which forces secret values to appear in generated output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime calls GET /chains (and GET /batches/{batchId}) and directly ingests the server’s JSON response into the agent’s LLM context; this is outsider-authored free text/content from the BadWhale API responses.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides an API-backed capability to assemble and submit transaction batches that create on-chain "fake-deposit" payments: it requires chain/network/token/to/amount fields, calls a submit endpoint (POST /batches) via bw.py, and returns/polls transaction results/tx URLs. This is a purpose-built crypto/blockchain execution tool (wallet/transaction submission), not a generic caller, so it grants direct financial execution authority.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)