x402

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text because the buyer flow can accept arbitrary user-provided URLs/queries (e.g., bazaar_search(query) / resolve_marketplace(url) / probe_402(url)), then reads the returned endpoint response text (r.text[:2000] and/or r.json()) to classify and proceed with payment.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payments/monetization system: it implements EIP-3009-style on-chain payment flows (USDC/USDG), facilitator /verify and /settle, buyer-side signing (Privy wallet / session EOA), and client scripts to discover, preflight, and execute payments (e.g., buy.py, client.paid_request, /x402/topup). It records settlements (on-chain tx hashes) and writes a local payments ledger. The README shows commands that perform real token transfers, on-chain settlements, and top-ups across multiple chains. These are specific payment/crypto execution capabilities (signing and settling real USDC payments), not generic tooling, so this skill grants direct financial execution authority.