handle-saas-billing-cases

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads live customer email threads and messages, introducing indirect prompt injection risk from inbound email content.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates subscription cancellations, refunds, voiding invoices, and payment retries (direct financial operations), but explicitly mandates human approval ("explicit current approval for the exact action") for every financial mutation (SKILL.md:32-35, SKILL.md:47-49, SKILL.md:71-73, SKILL.md:95-98, SKILL.md:120-123). This constitutes strong external approval qualifying as independent control.