agentcash

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly tells the agent to run npx agentcash discover <origin> and to "Read the output carefully" (including an instructions field) and it lists services that scrape web pages and social media (e.g., Firecrawl, stablesocial.dev), so the agent will fetch and interpret untrusted public third‑party content that can affect subsequent calls and workflow decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs runtime calls such as npx agentcash@latest discover https://stableenrich.dev (and other stable*.dev origins) which return an "instructions" field the agent is told to read and follow, so remote URL-hosted content can directly control agent prompts/workflow at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payment execution tool. It authorizes and performs micropayments (USDC on Base, Solana, Tempo), manages wallets (balance, funding addresses, deposit links, guided fund flow), and will "attempt authentication" and pay when calling payment-protected endpoints (npx agentcash fetch). These are direct crypto/payment actions (wallet auth, sending payments/settling on success), so it is specifically designed to move money.