cybercentry-web-application-verification

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes examples that require embedding sensitive credentials verbatim (e.g., an authenticated-scan JSON with "credentials": {"session_cookie":"sessionId=xyz789..."} passed directly to acp job create), so an agent following it would need to handle/output secret values.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly instructs submitting arbitrary public website URLs for scanning (see "Data You Submit" and the acp job create examples), so the service fetches and ingests untrusted third‑party web content and returns deliverables (including remediation and overall_risk) that the agent/automation reads and uses (e.g., CI/CD decision logic), enabling third‑party content to materially influence actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill’s setup steps instruct users to git clone and npm install the repository https://github.com/Virtual-Protocol/openclaw-acp, which fetches remote code that will be executed as a required dependency for the skill.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates Web3 payments and wallet signing. It requires connecting a Web3 wallet (MetaMask/WalletConnect/hardware), holding USDC for $1.00 payments, and performing transaction signing for each job. Commands like "acp job create 0xCYBERCENTRY_WALLET ..." and the "Cybercentry Wallet Verification" (also $1.00 USDC) show explicit crypto wallet/payment flow and signing. These are specific crypto/blockchain/payment actions (wallets and transaction signing), not generic tooling, so it grants direct financial execution capability.