Web3 Smart Contract Auditor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow rag_qa ingests retrieved chunk text (which originates from outsider-authored code/URLs provided to rag_ingest) into the LLM via RagQA.answer() where it builds the prompt context from chunk text and sends it to self.llm.ask().

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The loader fetches arbitrary web content at runtime (e.g., via jina: "https://r.jina.ai/{target_url}" and direct GitHub/raw URLs such as "https://raw.githubusercontent.com/{user}/{repo}/{branch}/{path}" or the example repo links), and that fetched text is injected into the RAG context/prompts used by the LLM, so remote URLs can directly control agent instructions.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for literal high-entropy credentials. I ignored obvious placeholders like "sk-your-openai-api-key-here" and "sk-ant-your-anthropic-api-key-here" (these are documentation placeholders and low-entropy examples). However, .env contains an unredacted, long, random-looking API key value for OPENROUTER_API_KEY (not labeled as a placeholder) which meets the definition of a secret (high entropy and usable). Therefore I flag that as a real secret and ignore the placeholder ANTHROPIC/OPENAI strings in .env/.env.example as documentation placeholders.