build-monetized-app

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The skill’s runtime path ingests outsider-authored free text from end users via the deployed app’s chat/proxy handler (e.g., handleChat reads await req.json() and forwards the user’s message body to the cloud /api/v1/messages), which then becomes LLM context for inference.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly about registering apps and enabling/applying monetization: it instructs using the Eliza Cloud SDK to register apps, "set markup %", and requires sending an affiliate header that "credits earnings" to the owner. The documentation explicitly references the redeemable_earnings_ledger, credit_transactions, and the container-billing cron that pulls earnings/credits. These are explicit monetization/crediting operations (internal financial ledger and revenue-crediting via API headers), not generic tooling. Therefore it provides direct financial execution capability for crediting/allocating earnings.