passkit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's "Updating Passes with Push Notifications" and "Adding a Pass to Wallet" sections describe loading and replacing .pkpass bundles and calling the pass's webServiceURL to fetch updates (arbitrary external URLs), which means the agent/app will ingest and act on untrusted third-party content that can change behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for integrating Apple Pay / PassKit: it defines merchant IDs, payment processing certificates, PKPaymentRequest creation, PKPaymentAuthorizationController flows, supported card networks, and handling/sending payment.token.paymentData to a payment processor. These are specific, purpose-built payment operations (directly accepting payments), not generic tooling. Therefore it grants direct financial execution capability.