flow-nexus-platform

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt repeatedly shows API keys, tokens, passwords, and DB URLs as parameters (e.g., env_vars.API_KEY, anthropic_key "sk-ant-...", database_url "postgres://user:pass...", login password fields) which instruct the agent to accept and embed secret values verbatim in generated calls and code, creating exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and uses user-published apps/templates and external repositories (e.g., App Store calls like mcp__flow-nexus__app_search, mcp__flow-nexus__template_get/template_deploy and sandbox startup scripts that git clone GitHub or sandbox_execute examples that fetch arbitrary URLs), meaning untrusted third‑party content is ingested and can directly influence deployments and tool actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit, purpose-built payment functions and credit-management APIs. Notably it provides mcp__flow-nexus__create_payment_link (returns a secure Stripe payment URL), mcp__flow-nexus__configure_auto_refill (automatically purchases credits when threshold met), and mcp__flow-nexus__app_store_earn_ruv (programmatically grants rUv credits). These are specific payment/credit operations (payment gateway integration and automated purchases/credit adjustments), not generic HTTP or browser tooling, so it grants direct financial execution capability.