flow-nexus-platform

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt repeatedly shows API keys, tokens, passwords, and DB URLs as parameters (e.g., env_vars.API_KEY, anthropic_key "sk-ant-...", database_url "postgres://user:pass...", login password fields) which instruct the agent to accept and embed secret values verbatim in generated calls and code, creating exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill exposes the agent to untrusted third‑party content because it explicitly allows sandboxed code to fetch arbitrary URLs (mcp__flow-nexus__sandbox_execute example), to git-clone public GitHub repos in startup scripts (Advanced Sandbox Configuration), and to retrieve public storage/execution files and user-published app/templates (storage_get_url, execution_file_get, app_store/template endpoints) which the agent would read and interpret.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit, purpose-built payment functions and credit-management APIs. Notably it provides mcp__flow-nexus__create_payment_link (returns a secure Stripe payment URL), mcp__flow-nexus__configure_auto_refill (automatically purchases credits when threshold met), and mcp__flow-nexus__app_store_earn_ruv (programmatically grants rUv credits). These are specific payment/credit operations (payment gateway integration and automated purchases/credit adjustments), not generic HTTP or browser tooling, so it grants direct financial execution capability.