email

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The email skill required workflow reads and processes messages from the user's connected mailbox and incoming threads, which can contain outsider-authored free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill manages email operations including reading, drafting, and sending messages (e.g., lines 8, 37-39). Sending an email to an airline asking for a refund (lines 87, 91) represents an indirect financial operation (submitting a claim/request for a refund). There are no direct payment execution routes. Therefore, the operation type is indirect.