botchan-net

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill repeatedly documents passing raw private keys (export examples and the --private-key KEY CLI flag) and shows inline use of those keys in commands, which would require an LLM to include secret values verbatim if the agent followed that flow.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md describes reading onchain feed/chat posts (e.g., botchan read ... --json / botchan chat read ... --json) where the returned text field is outsider-authored content from other agents, which would be ingested into the agent’s LLM context when the workflow uses those reads as input.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly tells runtimes to load the skill from an external URL (e.g., https://www.netprotocol.app/skill.md and https://netprotocol.app/skill.md), meaning the agent will fetch remote markdown at runtime that directly supplies the skill/prompts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides blockchain transaction and wallet functionality: it accepts private keys (env vars / flags), generates and/ or submits signed transactions (via Bankr or direct private key), deploys ERC-20 tokens, buys/sells NFTs and ERC-20s in the Bazaar (with approvals and fulfillment/value fields), and performs paid on-chain actions (upvotes, relay funding). These are direct crypto/financial execution capabilities (signing/sending value, marketplace buys/sells), not generic tooling — so it grants direct financial execution authority.