Lemon Squeezy Automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow interacts with Lemon Squeezy order, subscription, and product data via Composio/Rube tools, which may ingest customer-submitted text fields (such as product reviews, custom order notes, or customer messages).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to add an external Model Context Protocol (MCP) server endpoint at runtime without establishing strong first-party provenance or independent integrity checks, presenting a weak external runtime dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill automates Lemon Squeezy tasks including checkouts, orders, and subscriptions via Composio and Rube MCP. These operations constitute direct financial transactions (purchases, subscriptions, and payment processing). Although the skill requires an active Lemon Squeezy connection managed through Rube (RUBE_MANAGE_CONNECTIONS), this relies on agent execution instructions rather than an independent service- or execution-layer access control enforced directly on the payment route by the execution environment itself, making it a high-severity direct operation.