@1365/xfree02

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). xfree02.py’s call command POSTs user-supplied JSON bodies (e.g., --json or the catalog’s example) to x402 via PROXY_BASE + e["path"], and the catalog includes an endpoint whose required field text is an arbitrary research query consumed by the hosted agent.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly performs on-chain payments: callers "sign a USDC payment per call" (on specified rails like eip155 chains and Solana), require the user's wallet to hold USDC, delegate payment to an x402 buy script, return settlement/tx-hash info, and instruct to pay the marketplace URL. These are specific crypto/payment execution operations (wallet signing, settlements), not generic I/O, so this grants Direct Financial Execution authority.