atxp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow can ingest outsider-authored free text via commands like npx atxp@latest search <query> (web pages scraped at runtime) and npx atxp@latest x <query> (user-generated X/Twitter posts), which are returned as readable text and may be passed into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill invokes npx at runtime (e.g., "npx atxp@latest"), which downloads and executes the atxp npm package from the npm registry (https://www.npmjs.com/package/atxp), so remote code is fetched and executed during skill runtime and the skill depends on it.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provisions and controls a funded wallet and exposes payment/funding interfaces. It lists Stripe payment links and USDC deposit addresses (crypto on Base and Solana) via the fund command, documents funded paid commands (image/music/video generation, LLM gateway calls, email send, phone send-sms, phone register, etc.) that consume agent balance, and states that the ATXP_CONNECTION token grants full access to the agent's wallet/identity. Those are specific financial capabilities (payment gateway + crypto wallet access + executing paid transactions), not generic tooling. Therefore it grants direct financial execution authority.