uniswap

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). This skill explicitly requires using web_fetch to retrieve live documentation from public third‑party sites (e.g., https://github.com/ApeWorX/uniswap-sdk/blob/main/README.md and related GitHub pages, and https://docs.apeworx.io/ape/stable), which the agent will read/interpret at runtime and therefore exposes it to untrusted external content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires fetching live documentation at runtime (e.g., https://github.com/ApeWorX/uniswap-sdk/blob/main/README.md, https://docs.apeworx.io/ape/stable, and https://github.com/ApeWorX/ape-tokens/blob/main/README.md), and those fetched pages are mandated to be used to control how the agent writes code and follows instructions, making them runtime-controlled external content the skill depends on.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed for on-chain crypto trading: it uses the uniswap-sdk and Ape to index pairs, find routes, and "make trades" (swaps) on Uniswap across networks. It also instructs setting up live accounts and Silverback integration for executing swaps. These are specific crypto/transaction capabilities (wallet/account setup, route-finding, and executing swaps), so this grants direct financial execution authority.