verify-submission

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md workflow and references explicitly instruct the agent to download and inspect submission files and open external proof URLs (e.g., GitHub PRs, deployed sites, IPFS) — including using browser skills — so the agent will fetch and interpret arbitrary public/user-generated third-party content that can influence approve/reject actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill repeatedly instructs running "npx @openant-ai/cli@latest" (fetching and executing code from the npm registry at runtime) which is a required external dependency that will execute remote code during skill operation, so it poses a runtime execution risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit, platform-specific commands that initiate escrow settlement and release funds to workers. The tasks verify ... --approve command is documented to "trigger escrow release, funds go to worker immediately" (and auto-approve on deadline also completes escrow). This is a specific financial action (initiating payouts), not a generic tool, so it constitutes direct financial execution authority.