qedgen

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow reads an existing spec.md (Step 1) or generates a draft SPEC.md from an Anchor IDL (Step 1.2), and that SPEC.md/IDL content is outsider-authored free text that the agent then ingests into its LLM context for subsequent proof-writing.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes explicit blockchain/crypto transaction constructs (TransferCpi, MintToCpi, BurnCpi, CloseCpi), token program constants (TOKEN_PROGRAM_ID, SYSTEM_PROGRAM_ID), and functions/lemmas around transfer CPIs (e.g., transferCpiValid, cancel_build_cpi). These are specific crypto/blockchain APIs (CPI/transfer primitives) rather than generic tooling, so by the criteria this constitutes direct financial execution capability.