lit-protocol-flows

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes examples and CLI usage that embed API keys/tokens directly (e.g., Authorization: Bearer YOUR_API_KEY, --key KEY), which encourages the agent to ask for and output secrets verbatim—an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md "Example: Signing oracle" shows flow code that calls fetch(params.url) and returns/uses the fetched body (and the skill documents public invoke/MCP endpoints), so the skill ingests arbitrary public URLs and uses untrusted third‑party content in its runtime workflow, which can materially influence behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill configures and uses runtime MCP endpoints (e.g., https://flows.litprotocol.com/mcp/) which an agent will contact to receive/control instructions, and it also instructs running a remote CLI via "npx -y @lit-protocol/flows" which fetches and executes code from npm—so external content can control prompts or execute code at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly built for paid flows and agent-to-agent commerce and documents concrete payment integrations: Credits loaded via Stripe, x402 which pays with USDC on Base, and MPP which completes via Stripe or Tempo. It also exposes crypto tooling in the TEE (ethers, Lit.Actions.getPrivateKey, example of creating a Wallet and signing), which enables blockchain signing/transactions. These are specific payment and crypto capabilities (payment gateways and blockchain wallets), so the skill grants direct financial execution authority.