moneybird

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). At runtime, the skill uses the ClawLink CLI to “actions/describe/run moneybird”, which necessarily fetches Moneybird-side metadata and action results (including free-form text like account data, emails/notes, or error messages) authored by the operating user’s Moneybird tenant/other parties, and then passes that readable text into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent to run "npx @useclawlink/cli ..." which at runtime fetches and executes remote code from the npm package (https://www.npmjs.com/package/@useclawlink/cli), so it relies on and runs external code as a required dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill connects an AI agent to Moneybird (an accounting/invoicing service) via ClawLink and exposes actionable operations through a CLI (npx @useclawlink/cli run moneybird --input ''). It explicitly states the agent "can read and act on it" and provides commands to discover and execute actions (including writes). Moneybird is a financial application (invoicing, payment/record management), and the skill grants the agent the ability to perform financial operations via the connected account (with stored OAuth credentials). Thus this is a specific financial integration that enables direct execution of financial/accounting actions.