agent-negotiation-protocol

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/negotiation_engine.py, the LLM ingests user/outsider-authored free text (buyer_intent and seller_capability) by embedding it directly into the runtime prompts sent to DashScope at QwenClient.chat() (via buyer_propose/seller_evaluate), so an attacker who can supply those fields can inject instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The negotiation engine calls the Qwen LLM API at runtime (https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions), and the model responses from this endpoint are used directly as agent proposals/decisions that the skill requires to operate.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly defines a payment/settlement protocol and settlement implementation: "x402 payment protocol (HTTP 402 → sign → verify → pay)" and references a settlement script (scripts/x402_settlement.py). It also references blockchain-specific artifacts (ERC-8004 reputation, "TX Hash: 0x...") and requires atomic settlement behavior. These are specific, payment-oriented mechanisms (signing, verifying, paying, TX hash) — not generic tooling — so the skill grants direct financial execution capability.