rocket-net-api

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes code examples that embed username/password literals and shows inserting a JWT bearer token into request headers, which would require an agent to accept and include secret values verbatim in generated requests or code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill calls Rocket.net API endpoints that return arbitrary hosted-site content and user-generated data (e.g., GET /sites/{id}/files/view, /sites/{id}/files/download, backup endpoints, access_logs and reporting endpoints), so the agent may ingest untrusted third-party content as part of its workflow.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit billing/payment endpoints that allow moving money: e.g., POST /billing/invoices/{invoiceId}/credit_card_payment ("Pay with card"), endpoints to list/add/delete payment methods (/billing/payment_methods), and billing address/invoice management. These are specific financial actions (payment gateway-style operations), so the skill grants direct financial execution capability.