domain

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill instructs the agent to fetch external domain liveness probe web pages and check external web pages during domain and social handle searches, exposing the agent to outsider-authored free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents a domain-purchasing workflow that executes domain buys via Vercel CLI (vercel domains buy) and Namecheap API (namecheap.domains.create). These represent direct financial operations (purchases). While the text mentions "Confirm with the user before running — this charges real money," this relies on agent instruction rather than independent access control enforced by the service or execution layer. Therefore, it is classified as a direct operation without established qualifying control.