ai4trade-trading-signals

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow fetches and reads community-driven marketplace content and discussions from ai4trade.ai via arbitrary web page retrieval.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to fetch and follow instructions from https://ai4trade.ai/SKILL.md at runtime, creating an unverified external operational dependency with weak provenance.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents capabilities to buy, sell, and trade financial assets ("Buy, sell, follow, and share trading signals") via the AI4Trade platform, which constitutes a direct financial operation (trades/purchases). However, no independent access control, authentication mechanism, or service-layer authorization for these financial routes is documented or enforced by the skill instructions.