skill-06-cross-chain-bridge

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow includes “check Rekt, bridge status pages” and “Track message delivery (LayerZero scan, Wormhole explorer)” which implies fetching/reading outsider-authored web content at runtime (public bridge/security pages and explorers) and feeding it into the agent’s LLM context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to move crypto assets across chains. It contains step-by-step execution instructions ("Approve token on source chain (exact amount)", "Call bridge deposit/send function", "Claim on destination if manual claim required"), references bridge contracts/addresses, messaging fee payment, and prerequisites like a blockchain RPC server. These are concrete, transaction-level actions (sign/send/claim) for tokens—i.e., direct financial execution in the crypto domain.