webhook-integration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests outsider-authored free text from HTTP webhook request bodies (untrusted JSON) via app/api/webhooks/dodo/route.ts reading await req.text() / JSON.parse(body) after signature/timestamp verification, which an outsider could send to the endpoint if they can POST.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a specific integration for a payment gateway (Dodo Payments) — it documents webhook events for payments, refunds, disputes, credits and shows code that uses a webhook secret to verify and process payment-related events. This is explicitly tied to a payment platform (a payment gateway) rather than a generic tool, so it meets the criterion for Direct Financial Execution authority.