caravo

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to run Caravo CLI tools that perform web/academic/search/scraping and social media queries (e.g., "scrape the pricing page of example.com", "search X/Twitter posts", "get Reddit post comments", "semanticscholar/paper-search") and to read and present those tool outputs as part of its workflow, which exposes the agent to untrusted, user-generated third-party content that could carry indirect prompt-injection instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires running "npx -y @caravo/cli@latest start" at first load, which fetches and executes remote code from the @caravo/cli npm package (https://www.npmjs.com/package/@caravo/cli) and uses the returned JSON (greeting/setup_hint) verbatim to control agent output, so this is a runtime-executed external dependency that directly controls prompts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). Yes. The skill explicitly provisions and uses a USDC wallet and signs micropayments on the Base network to pay for tool calls. The doc states payments are "handled automatically via a local USDC wallet", that the CLI auto-creates ~/.caravo/wallet.json, and that the private key "is used solely to sign USDC micropayments on the Base network." It also documents payment modes (API key vs x402 USDC mode) and commands like npx ... wallet and login/logout. This is a specific, built-in crypto payment/transaction capability (signing and sending USDC payments), not a generic API caller or browser automation, so it qualifies as direct financial execution.