ticket-deflector

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow ingests customer support emails and tickets forwarded or pasted by the user, which can contain arbitrary outsider-authored text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill contains explicit capabilities and instructions for issuing refunds via PayPal (Payment Gateways), as evidenced by tool references such as "can issue a PayPal refund", "Pull PayPal transaction status", and workflow steps specifically detailing how to issue a refund through the PayPal integration.