cross-source-analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). SKILL.md instructs the agent to read an injected <data-dictionary> and to fetch per-source data from multiple external systems (e.g., HubSpot, Zendesk/Pylon, Common Room, Gong, Jira, Prometheus/Grafana), which at runtime can include outsider-authored free text (ticket bodies, call transcript text, community posts) that may be ingested into the LLM context via provider actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly references a payment gateway API (Stripe) in a provider-api-request example (provider: "stripe", path: "/charges"), which is a specific, non-generic integration with a payment provider. That qualifies as a direct financial-related API capability (payment gateway) under the rules, so it is flagged as Direct Financial Execution risk.