api-integration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's SKILL.md shows code that fetches and processes data from external/public APIs and webhooks — e.g., the "Universal API Client" and "OpenAIIntegration" examples and the "Webhook Handling" section that parses JSON events from providers (and mentions social media/APIs like Twitter, Facebook, Stripe) — so untrusted third-party payloads are ingested and routed to handlers that can change behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes payment gateway integrations: it names Stripe and PayPal in the use-cases and provides a concrete "StripePaymentIntegration" class with a createPaymentIntent method that calls stripe.paymentIntents.create and returns client_secret/paymentIntentId. It also includes webhook handling for payment events (e.g., payment.succeeded). These are specific, purpose-built APIs for initiating and handling payments—i.e., direct financial execution capabilities.