finance-district

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to obtain an email OTP from the user or inbox and use it verbatim in commands like fdx verify --code <OTP> (and guides API key management), which requires the LLM to handle and output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The skill's x402 payment workflow (SKILL.md "Paying for services (x402)" and references/x402-payment-flow.md) requires the agent to call arbitrary resource servers, read their HTTP 402 JSON payment requirements, and use that untrusted third-party content to choose and authorize payments—which can directly influence subsequent tool actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's x402 payment flow involves calling arbitrary resource server URLs at runtime which can return a 402 PaymentRequired JSON that the agent must parse and pass into fdx wallet authorizePayment (i.e., external response directly controls the agent's signing/behavior) — see the x402 spec/flow (https://github.com/coinbase/x402/blob/main/specs/x402-specification-v2.md) as the relevant runtime endpoint pattern.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly and specifically designed for financial operations. It exposes the fdx CLI with wallet and Prism payment gateway commands that perform concrete money-moving actions: create/setup wallets, send/transfer tokens, execute swaps (with Execute mode), deposit/withdraw to DeFi vaults, stake/earn yield, bridge tokens, authorize x402 payments, and manage merchant settlement wallets and API keys. These are direct financial execution capabilities (crypto transfers, swaps, payment authorization, merchant settlement), not generic tooling. Therefore it meets the criteria for Direct Financial Execution.