xyo-knowledge

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly instructs reading application-level payloads from public datalakes/archivists (see "Trust boundary on chain reads" in best-practices.md and the archivist/XL1 datalake discussion in modules.md), which are writable by anyone and therefore expose the agent to untrusted, user-generated content that the agent is expected to parse and act on.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly covers "Identity & Signing" including accounts, wallets, key management, signing, and HD derivation. Those are specific crypto/blockchain capabilities (wallets and signing) that enable transaction signing and therefore direct financial execution in the crypto context. This is not a generic tool; it is specifically about wallet/key management and signing.