restaurant-booking

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill instructs the agent to browse restaurant reservation sites like OpenTable and Resy and read restaurant official sites, which involves fetching arbitrary web pages and public registries containing outsider-authored content.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill makes, changes, or cancels restaurant reservations through third-party platforms like OpenTable and Resy, involving deposits, prepaid menus, and card holds (direct financial operations such as purchases/charges/holds). These direct actions rely on provider accounts, signed-in provider sessions, and saved payment methods with external user authentication on the platform itself, establishing independent access control.