chainlink-confidential-ai-attester-skill

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The API includes explicit mechanisms that will send the full request/result data to arbitrary external URLs (cre_callback) and will fetch arbitrary user-provided URLs server-side, enabling straightforward data exfiltration (and SSRF-assisted exfiltration) of sensitive uploaded documents and inputs to attacker-controlled endpoints.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow ingests outsider-authored free text indirectly when a requester supplies resources.url (or provides base64-encoded document content) in POST /v1/inference, and the server fetches that URL at inference time and sends the resulting text to the LLM for analysis.