testing-and-go-live

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes webhook testing via the Dodo CLI “listen”/“trigger” flows that forward received webhook payloads to the local URL, meaning outsider-authored event bodies from the network can be ingested by the required runtime workflow (the skill explicitly notes the payloads are handled/verified at runtime).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payments integration for "Dodo Payments" and contains concrete API calls and CLI commands that perform payment operations: creating checkout sessions (checkoutSessions.create), updating subscriptions (client.subscriptions.update to schedule/force billing), creating live products (liveClient.products.create), and handling API keys for test vs live modes. These are specific payment gateway actions (moving money / managing charges and subscriptions), not generic tooling, so it grants direct financial execution capability.