contract-to-billing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md Phase 1 explicitly says the agent “Get the document” (including pasted text and local files) and “Read the entire document” to extract billing details, meaning the LLM ingests outsider-authored free-form document text at runtime when the user uploads/references a third-party contract/PO/quote.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to operate Airwallex Billing and perform billing write actions: it creates invoices/subscriptions, adds line items, finalizes invoices, voids and marks invoices-as-paid, and manages products/prices/customers. These are specific billing/payment API operations (Airwallex Billing — analogous to Stripe/PayPal) rather than generic tooling, so it grants direct financial execution capability for receivables and invoice lifecycle actions.