strk20-privacy-integration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime exposes outsider text via scripts/check_freshness.py fetching and parsing free-form repo/HTTP content from third-party sources (npm registry, GitHub API, and scanning .md files for URLs then probing those URLs), which can include user-authored text returned by those services’ APIs/pages.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly about integrating crypto payment/transfer functionality on Starknet: it references shielding/unshielding/swaps, the Privacy Wallet API via starknet.js, a Privacy Bridge that moves USDC via CCTP, and SDK routes for teams that manage keys/accounts. These are specific crypto/transaction capabilities (wallet signing, token transfers, bridges), not generic tooling.