swap-planner

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and ingests public, untrusted third-party content (e.g., DexScreener API calls in "Step 0: Token Discovery" and references/data-providers.md and the "use web search" instruction in Step 4) and uses those results to research tokens, assess risk, and generate swap deep-links that directly affect actions and recommendations.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly and primarily designed for crypto token swaps: it guides "swap tokens", "trade ETH for USDC", verifies token contracts on-chain (eth_getCode RPC calls), fetches price/liquidity data, and generates Uniswap swap deep links (and can open the Uniswap interface) with parameters pre-filled to execute swaps. This is a targeted crypto swap capability (not a generic browser/API tool), so it constitutes direct financial execution authority for crypto swaps.