mev-protection

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Required runtime ingests user-supplied JSON on stdin (e.g., tx_hash, contract_address, tx_data) and then fetches transaction/mempool-relevant data from third-party RPC endpoints to analyze it, so outsider-provided free text can influence what the system reads/uses at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes a specific "flashbots_relay" capability that submits transactions via Flashbots Protect (inputs include full tx_data: from, to, data, value, gas, and max_priority_fee) and returns a bundle submission confirmation. The usage workflow explicitly says to use flashbots_relay to submit when the user approves, and troubleshooting mentions verifying the private key for Flashbots submission. This is a concrete crypto/blockchain transaction submission tool (directly moves/signs/submits funds), so it constitutes Direct Financial Execution authority.