zerion-bankr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to browse public sites (e.g., the "Advanced: x402 paid APIs, arbitrary calldata, web browse" section and the example "bankr agent prompt 'Browse coingecko.com and get the top trending tokens'") and to resolve social handles (Twitter/Farcaster), meaning the agent will fetch and interpret untrusted public/user-generated content that can directly influence trading/execution decisions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly pairs a read-only Zerion research layer with Bankr as an execution layer that signs and broadcasts on-chain transactions from a Bankr multi-chain wallet. It includes concrete, purpose-built commands for moving value and executing market operations, e.g.:
• Direct transfers: bankr wallet transfer --to <addr> --token <sym> --amount <n> and examples like "Send 0.1 ETH to @friend".
• Trading and orders: natural-language execution bankr agent prompt "Buy $100 of ETH", swaps, "Swap 50 USDC for PEPE", and spot trades.
• Automated/brokerage features: DCA, limit orders, stop-loss via bankr agent prompt "DCA $100 into ETH every Friday", scheduled automation.
• Leverage and derivatives: Hyperliquid perp commands like "Short $500 of ETH ... with 5x leverage".
• Cross-chain and bridging: "Bridge 200 USDC from Polygon to Base".
• Market actions and deployments: Polymarket bets, NFT buys/transfers, and ERC20 token deploys on Base.
• Arbitrary transaction submission: bankr agent prompt "Submit this transaction: {to:0x..., data:0x..., value:0, chainId:8453}".

These are specific, first-class financial execution features (signing/broadcasting transactions, transferring tokens, placing trades, updating orders), not generic tooling. Therefore it grants Direct Financial Execution Authority.