self-hosted-funnel-launch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow exposes an MCP admin API (at /api/mcp) that an outsider can invoke via natural-language tool calls to create/update funnel pages, causing the LLM to ingest free text they author as page draftData/htmlContent through the agent→tool inputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's setup instructions explicitly fetch and run remote code (Get the repository from https://github.com/autonnel/autonnel and run the container image ghcr.io/autonnel/autonnel:v1.5.0), which will execute externally sourced code at install/runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates payment gateways ("Payments | Taking money | Stripe, PayPal" at SKILL.md:148), requires executing a real purchase and a refund as part of pre-launch checks (SKILL.md:188-189), and exposes an admin API as MCP tools that can be given write access to agents (SKILL.md:198-216). It also lists order-related mutating tools (e.g., deliver_order) reachable via MCP (SKILL.md:259) and calls out payment configuration and PCI scope (SKILL.md:269). These points indicate the skill is specifically designed to take and manage payments (and refunds) via payment providers, i.e., it provides direct financial execution capability.