moyasar

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow monitors and consumes webhooks and callback inputs containing outsider-submitted payment event payloads and parameters.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill integrates the Moyasar payment gateway REST API, supporting direct financial operations such as creating, capturing, refunding, and voiding payments, managing payouts, and handling card tokens. Access to these direct payment operations is gated by HTTP Basic Authentication using Moyasar API keys (secret keys sk_ for backend operations and publishable keys pk_ for client-side token/payment creation), which represents established service authentication/credentials satisfying qualifying control.