beneficiary-creation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires extracting and then displaying/constructing full beneficiary payloads (bank account numbers, routing values, tax IDs, etc.) and to show/send those payloads for validate/create/verify, which forces the LLM to handle and emit sensitive secret values verbatim into outputs/requests.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs the agent to WebFetch the external documentation at https://www.airwallex.com/docs/payouts/payout-network/bank-accounts/{country-slug} at runtime and to rely on that fetched content to determine required fields and validations, so the external URL directly controls agent behavior.