ton-send

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text is ingested directly from the user’s provided recipient address/DNS name (and optional natural-language confirmation comment) in the Send GRAM/Jetton workflows before calling resolve_dns/build_* and confirmation, with no requirement to pre-select a trusted item.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly implements cryptocurrency transfer functionality: it provides build_ton_transfer and build_jetton_transfer to construct transactions, emulate_transaction to preview, and send_raw_transaction which "actually signs and broadcasts" transactions. The workflows instruct the agent to broadcast transfers and poll transaction status. This is a specific crypto/blockchain payment capability (sending GRAM/jettons), i.e., direct financial execution.