mandate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's SKILL.md explicitly describes an "x402 Payment Flow" where the agent performs an HTTP request to a paywall URL and parses an X-Payment-Required header (third-party website response) to construct a payment transaction, which the agent is expected to read and act on—evidence the agent ingests untrusted public web content that can materially influence subsequent tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill mandates runtime calls to https://app.mandate.md/api (e.g., POST /validate) which are required before every transaction and return decisions and messages (allowed/blockReason/declineMessage) that directly control agent prompts and behavior, so this is a runtime external dependency that can control instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly and specifically designed for financial operations. It provides wallet- and transaction-focused APIs and CLI/SDK commands (POST /validate, /validate/raw, mandate transfer, MandateWallet.transfer), interacts with crypto wallets (Bankr, Locus, Sponge, self-custodial keys), encodes/broadcasts ERC20 transfers, supports swaps/bridges/stakes, and enforces spend limits/approval workflows. These are concrete crypto/payment transaction tools, not generic utilities, so it grants direct financial execution capability.