factory-conductor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow consumes an outsider-submitted plan envelope and executes arbitrary verification command-line strings defined within it.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates an offline task conductor that checks budgets (ledger.py check) and prepares local git worktrees, pull requests, and usage envelopes, but it explicitly forbids making actual payments, calling payment APIs, or executing direct money transfers, establishing an indirect financial scope (managing budgets, check requests, and usage records) where no direct monetary transfers or purchases occur.