@432/meta-dex-aggregator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime, the quote workflow calls multiple outsider APIs (e.g., ParaSwap/Odos/KyberSwap/0x) via requests.get/post and then passes their JSON fields (like priceRoute, routeSummary, transaction, and error strings) into the agent’s returned JSON context; these are free-form data from third parties, which can include attacker-controlled text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto DEX aggregator that prepares and executes on-chain token swaps and cross-chain transfers. It names and uses concrete execution functions and APIs: oneinch_quote/oneinch_swap, oneinch_cross_chain_quote/oneinch_cross_chain_swap, LI.FI routes that "return ready-to-sign tx data", and wallet_transfer(to, amount, data, chain_id). It also handles ERC-20 approvals (oneinch_check_allowance → oneinch_approve) and executes transactions using produced tx.data. These are direct mechanisms to move funds (sign/send transactions and perform swaps/bridges), not generic tooling. Therefore it grants direct financial execution authority.