paperclip-admin

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In paperclip-admin, the workflow performs runtime reads of Paperclip control-plane records (e.g., issues/comments and executions) via paperclipai/MCP/API, and those records can include outsider-authored free text entered into Paperclip (such as issue comments/documents) that the LLM then ingests.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly allows updating agent budgets and warns that "budget reduction" is a destructive change. It lists inspecting/verifying agent budgets and "adjusting an agent budget" as an authorized minor mutation, which constitutes an API-capable budget update (direct financial execution capability).