flights

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow ingests external emails and support messages ("unanswered hotel pickup email", check-in confirmations, etc.) which can contain outsider-authored text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill includes flight booking and payment workflows ("Book, change, or check in", line 24; follow confirmation policy for booking or payment and use the Wallet skill, line 26), which constitute direct financial operations (purchases/charges). These direct operations rely entirely on instructions/policies (<confirmation_policy>) rather than an independent service-level authentication or authorization check enforced by the execution layer. Therefore, it is a direct operation without established qualifying control, resulting in high severity.