dflow-docs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs the runtime to fetch and read a remote, public text index (curl ... https://pond.dflow.net/llms.txt -o skills/dflow-docs/llms.txt and sed -n ... skills/dflow-docs/llms.txt), so outsider-authored free text from the public web can be ingested into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill contains an installation command that fetches and immediately executes remote code via "curl -fsS https://cli.dflow.net | sh", which runs code from https://cli.dflow.net at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly targets financial operations: it includes Solana spot swaps, Kalshi market buy/sell/redemptions, Phantom wallet integration, and a clear statement that "Trading commands submit real transactions." These are specific crypto/market trading and wallet execution capabilities (direct transaction submission), which constitute Direct Financial Execution authority.