locus-agent-tools

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow reads outsider-authored free text from the user’s natural-language “place”/“address”/“intent” inputs to drive tool planning and then calls Locus tools using that untrusted text (e.g., locus_suggest_workflow, locus_coverage_check, locus_lane_availability, locus_place_facts), making prompt-injection via user-provided strings a medium risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent to fetch live discovery/manifests at runtime (for example https://api.locus.report/.well-known/locus-tools.json and the MCP endpoint https://mcp.locus.report/mcp), and those manifests directly determine tool names/schemas and thus control the agent's prompts/invocations, so this is a runtime external dependency that can change agent behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL.md explicitly documents paid endpoints and an on-chain payment flow (x402) using Base USDC, including how to obtain and retry a PaymentRequired 402 challenge, attach a PAYMENT-SIGNATURE/X-PAYMENT header, read amount/network/asset/payTo, and read settlement receipts. It even references wallet clients (AgentCash) and the exact network (eip155:8453). These are specific crypto/payment integration instructions (signing and sending payment credentials) that grant the agent the ability to execute financial settlement for paid tool calls.