xl1-knowledge

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's docs explicitly instruct runtime code to fetch and hydrate off-chain, application/user-provided payloads from public datalake endpoints (e.g., createRestDataLakeViewer against https://api.archivist.xyo.network/dataLake and gateway.connection.viewer.block.payloadsByHash or transaction.byHash in Datalakes.md and Gateway.md), so the agent is expected to read untrusted third-party content during block-walk/indexing workflows that can materially influence processing or subsequent actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly documents wallet and signer APIs and patterns for creating and using keys to sign/send transactions: e.g., "generateXyoBaseWalletFromPhrase + derivePath", "AccountInstance" wrapped via "buildSimpleXyoSignerV2", the "seed-phrase signer pattern", and a "GatewayBuilder" that can be "write-capable". It also covers transactions, fees, staking and gateway write-capability — all of which are specific crypto/blockchain signing and transaction execution capabilities. These are explicit tools for signing and submitting blockchain transactions (direct financial execution).